CVE-2015-3113 Adobe Flash Player Heap-Based Buffer Overflow
Remote attackers can execute arbitrary code via a heap-based buffer overflow in Adobe Flash Player, requiring users to upgrade to patched versions.
- Exploited in the wild
- Since 13 Apr 2022
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-3113?
CVE-2015-3113 is a high-severity memory corruption vulnerability in Adobe Flash Player, published on 23 Jun 2015. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
Which versions are affected by CVE-2015-3113?
It affects 15 products.
Linux distribution packages (5)
flash-plugin Red Hat:rhel_extras:5::client | All versions | 0:11.2.202.468-1.el5 |
flash-plugin Red Hat:rhel_extras:5::server | All versions | 0:11.2.202.468-1.el5 |
flash-plugin Red Hat:rhel_extras:6 | All versions | 0:11.2.202.468-1.el6_6 |
flash-player SUSE:Linux Enterprise Desktop 12 | All versions | 11.2.202.468-89.1 |
flash-player SUSE:Linux Enterprise Workstation Extension 12 | All versions | 11.2.202.468-89.1 |
Products include Adobe Flash Player, Hp Insight Orchestration, Hp System Management Homepage, Hp Systems Insight Manager, Hp Version Control Agent, Hp Version Control Repository Manager and 9 more.
How do I fix CVE-2015-3113?
Upgrade to a fixed version. US federal agencies must fix it by 4 May 2022.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2015-3113 being exploited?
Yes. Attackers have exploited CVE-2015-3113 in the wild since at least 13 Apr 2022.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as GHSA-fcrm-7q5r-w4rw, RHSA-2015:1184, SUSE-SU-2015:1136-1, UBUNTU-CVE-2015-3113.