CVE-2015-0311 Adobe Flash Player Remote Code Execution
Remote attackers can execute arbitrary code on systems running Adobe Flash Player via unknown vectors, requiring immediate upgrades.
- Exploited in the wild
- Since 13 Apr 2022
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-0311?
CVE-2015-0311 is a high-severity code injection vulnerability in Adobe Flash Player, published on 23 Jan 2015. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.
Which versions are affected by CVE-2015-0311?
It affects 5 products.
Products include Adobe Flash Player, Microsoft Edge, Microsoft Internet Explorer, Suse Linux Enterprise Desktop, Suse Linux Enterprise Workstation Extension.
How do I fix CVE-2015-0311?
Upgrade to a fixed version. US federal agencies must fix it by 4 May 2022.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2015-0311 being exploited?
Yes. Attackers have exploited CVE-2015-0311 in the wild since at least 13 Apr 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as GHSA-xvc3-rmmw-6hxp, UBUNTU-CVE-2015-0311.