CVE-2015-7645 Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF fi...
HighCVSS 7.8
EPSS 65.3%
CISA KEV
added 2022-03-03 · due 2022-03-24
Ransomware
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-03
- Due date (FCEB)
- 2022-03-24
- Ransomware use
- Known
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe flash player | >= 18.0.0.160, <= 18.0.0.252 | No fix listed |
| Adobe flash player | = 19.0.0.185 | No fix listed |
| Adobe flash player | = 19.0.0.207 | No fix listed |
| Adobe flash player | <= 11.2.202.535 | No fix listed |
| openSUSE evergreen | = 11.4 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp3 | No fix listed |
| SUSE linux enterprise desktop | = 11-sp4 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise workstation extension | = 12 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux eus | = 6.7 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server from rhui | = 5.0 | No fix listed |
| redhat enterprise linux server from rhui | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
References
- blog.trendmicro.com broken-link
- openSUSE-SU-2015:1768 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:1770 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:1771 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:1781 mailing-list third-party-advisory vendor-advisory
- packetstormsecurity.com third-party-advisory vdb-entry
- RHSA-2015:1913 third-party-advisory vendor-advisory
- RHSA-2015:2024 third-party-advisory vendor-advisory
- 77081 broken-link third-party-advisory vdb-entry
- 1033850 broken-link third-party-advisory vdb-entry
- helpx.adobe.com broken-link patch vendor-advisory
- helpx.adobe.com broken-link
- GLSA-201511-02 third-party-advisory vendor-advisory
- 38490 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource