[ CVE-2015-0311 · Published 23 Jan 2015 ]
Adobe Flash Player Remote Code Execution Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 86%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-04-13
- EPSS: 86% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
CISA: Unspecified vulnerability in Adobe Flash Player allows remote attackers to execute code.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 4 May 2022): The impacted product is end-of-life and should be disconnected if still in use.
- Patch on technet.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- helpx.adobe.com/security/products/flash-player/apsa15-01.htmlVendor Advisory
- helpx.adobe.com/security/products/flash-player/apsb15-03.htmlBroken Link
- lists.opensuse.org/opensuse-security-announce/2015-01/msg00027.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-01/msg00031.htmlMailing ListThird Party Advisory
- malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.htmlThird Party Advisory
- secunia.com/advisories/62432Broken Link
- secunia.com/advisories/62543Broken Link
- secunia.com/advisories/62650Broken Link
- secunia.com/advisories/62660Broken Link
- secunia.com/advisories/62740Broken Link
- security.gentoo.org/glsa/glsa-201502-02.xmlThird Party Advisory
- www.securityfocus.com/bid/72283Broken LinkThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1031597Broken LinkThird Party AdvisoryVDB Entry
- technet.microsoft.com/library/security/2755801PatchVendor Advisory
- github.com/cisagov/vulnrichment/issues/196Issue Tracking
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource