CVE-2015-5122 Adobe Flash Player Use-After-Free
Remote attackers can execute arbitrary code or cause denial of service via crafted Flash content exploiting a use-after-free flaw in Adobe Flash Player.
- Exploited in the wild
- Since 13 Apr 2022
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-5122?
CVE-2015-5122 is a high-severity use after free vulnerability in Adobe Flash Player, published on 14 Jul 2015. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.
Weakness: CWE-416
Which versions are affected by CVE-2015-5122?
It affects 9 products.
Products include Adobe Flash Player, Adobe Flash Player Desktop Runtime, Opensuse Evergreen, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Eus and 3 more.
How do I fix CVE-2015-5122?
Apply the vendor's patch. US federal agencies must fix it by 4 May 2022.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2015-5122 being exploited?
Yes. Attackers have exploited CVE-2015-5122 in the wild since at least 13 Apr 2022.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as GHSA-9h3m-vp3m-35pw, UBUNTU-CVE-2015-5122.