CVE-2015-5119 Adobe Flash Player Use-After-Free
Remote attackers can execute arbitrary code or cause denial of service via crafted Flash content exploiting a use-after-free flaw in Adobe Flash Player.
- Exploited in the wild
- Since 3 Mar 2022
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-5119?
CVE-2015-5119 is a high-severity use after free vulnerability in Adobe Flash Player, published on 8 Jul 2015. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
Weakness: CWE-416
Which versions are affected by CVE-2015-5119?
It affects 11 products.
Products include Adobe Flash Player, Opensuse Evergreen, Opensuse Opensuse, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server and 5 more.
How do I fix CVE-2015-5119?
Apply the vendor's patch. US federal agencies must fix it by 24 Mar 2022.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2015-5119 being exploited?
Yes. Attackers have exploited CVE-2015-5119 in the wild since at least 3 Mar 2022.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 3 proofs of concept on GitHub.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as GHSA-3792-ff84-674w, UBUNTU-CVE-2015-5119.