CVE-2015-3113 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbit...
CriticalCVSS 9.8
EPSS 99.8%
CISA KEV
added 2022-04-13 · due 2022-05-04
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
CISA Known Exploited Vulnerability
- Date added
- 2022-04-13
- Due date (FCEB)
- 2022-05-04
- Ransomware use
- Unknown
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe flash player | < 13.0.0.296 | 13.0.0.296 |
| Adobe flash player | >= 14.0.0.125, < 18.0.0.194 | 18.0.0.194 |
| Adobe flash player | < 11.2.202.468 | 11.2.202.468 |
| openSUSE evergreen | = 11.4 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise workstation extension | = 12 | No fix listed |
| HP Inc insight orchestration | < 7.5.0 | 7.5.0 |
| HP Inc system management homepage | < 7.5.0 | 7.5.0 |
| HP Inc systems insight manager | < 7.5 | 7.5 |
| HP Inc version control agent | < 7.5.0 | 7.5.0 |
| HP Inc version control repository manager | < 7.5.0 | 7.5.0 |
| HP Inc version control repository manager | = 7.6 | No fix listed |
| HP Inc virtual connect enterprise manager | < 7.5.0 | 7.5.0 |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux eus | = 6.6 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
References
- SUSE-SU-2015:1136 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:1148 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:1180 mailing-list third-party-advisory vendor-advisory
- HPSBMU03409 mailing-list vendor-advisory
- RHSA-2015:1184 third-party-advisory vendor-advisory
- 75371 broken-link third-party-advisory vdb-entry
- 1032696 broken-link third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking
- bugzilla.suse.com issue-tracking
- h20564.www2.hpe.com broken-link
- helpx.adobe.com broken-link patch vendor-advisory
- GLSA-201507-13 third-party-advisory vendor-advisory
- www.suse.com third-party-advisory
- github.com issue-tracking
- www.cisa.gov government-resource us-government-resource