CVE-2015-3113

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

The impacted product is end-of-life and should be disconnected if still in use.

Added 2022-04-13Remediation due 2022-05-04

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

9.8

CVSS

99.9%

EPSS (exploit prob.)

100th

EPSS percentile

2015-06-23

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-787CWE-122

Affected products

Vendor	Product	Affected versions
adobe	flash_player	< 13.0.0.296
adobe	flash_player	>= 14.0.0.125, < 18.0.0.194
apple	mac_os_x	all versions
microsoft	windows	all versions
adobe	flash_player	< 11.2.202.468
linux	linux_kernel	all versions
opensuse	evergreen	11.4
opensuse	opensuse	13.1
opensuse	opensuse	13.2
suse	linux_enterprise_desktop	12
suse	linux_enterprise_workstation_extension	12
hp	insight_orchestration	< 7.5.0
hp	system_management_homepage	< 7.5.0
hp	systems_insight_manager	< 7.5
hp	version_control_agent	< 7.5.0
hp	version_control_repository_manager	< 7.5.0
hp	version_control_repository_manager	7.6
hp	virtual_connect_enterprise_manager	< 7.5.0
redhat	enterprise_linux_desktop	6.0
redhat	enterprise_linux_eus	6.6
redhat	enterprise_linux_server	6.0
redhat	enterprise_linux_workstation	6.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2015-3113