PT-2015-1007 · Adobe+3 · Flash Player+3

Kafeine · Published 2015-01-22 · Updated 2025-11-17 · CVE-2015-0311

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.263 Adobe Flash Player versions 14.x through 16.x prior to 16.0.0.288 Adobe Flash Player version 11.2.202.438 and earlier on Linux

Description The issue is related to a use-after-free vulnerability in the ByteArray::UncompressViaZlibVariant() function, allowing a remote attacker to execute arbitrary code or cause a denial of service via a specially crafted swf file. This vulnerability has been exploited in the wild, with reports of its use in January 2015.

Recommendations For Adobe Flash Player versions prior to 13.0.0.263, update to version 13.0.0.263 or later. For Adobe Flash Player versions 14.x through 16.x prior to 16.0.0.288, update to version 16.0.0.288 or later. For Adobe Flash Player version 11.2.202.438 and earlier on Linux, update to a version later than 11.2.202.438.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-17

CWE-416

Related Identifiers

ALT-PU-2015-1076

ALT-PU-2015-1103

BDU:2015-09810

BDU:2015-09811

BDU:2015-10322

CVE-2015-0311

MGASA-2015-0043

OPENSUSE-SU-2015_0150-1

OPENSUSE-SU-2015_0174-1

RHSA-2015:0094

RHSA-2015_0094

SUSE-SU-2015_0151-1

SUSE-SU-2015_0163-1

Affected Products

Alt Linux

Flash Player

Red Hat

Suse

References · 35

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_uncompress_zlib_uaf.rb · Exploit
• 🔥 https://exploit-db.com/exploits/36360 · Exploit
• http://helpx.adobe.com/security/products/flash-player/apsa15-01.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-0311 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0311 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0311 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0043 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-0311 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09811 · Security Note
• https://bdu.fstec.ru/vul/2015-10322 · Security Note
• https://bdu.fstec.ru/vul/2015-09810 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-0311 · Security Note
• https://advisories.mageia.org/MGASA-2015-0043.html · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00031.html · Vendor Advisory
• https://technet.microsoft.com/library/security/2755801 · Vendor Advisory