PT-2015-1511 · Adobe+3 · Flash Player+3

Will Dormann · Published 2015-07-10 · Updated 2025-11-17 · CVE-2015-5122

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions 11.x through 11.2.202.481 Adobe Flash Player versions 12.x through 18.0.0.204 Adobe Flash Player versions 13.x through 13.0.0.302 Adobe Flash Player versions 14.x through 18.0.0.203

Description The issue is related to a use-after-free vulnerability in the DisplayObject class in the ActionScript 3 implementation. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via crafted Flash content that leverages improper handling of the opaqueBackground property. The vulnerability has been exploited in the wild.

Recommendations For Adobe Flash Player versions 11.x through 11.2.202.481, update to a version later than 11.2.202.481 to resolve the issue. For Adobe Flash Player versions 12.x through 18.0.0.204, update to a version later than 18.0.0.204 to resolve the issue. For Adobe Flash Player versions 13.x through 13.0.0.302, update to a version later than 13.0.0.302 to resolve the issue. For Adobe Flash Player versions 14.x through 18.0.0.203, update to a version later than 18.0.0.203 to resolve the issue. As a temporary workaround, consider disabling the use of crafted Flash content that leverages the opaqueBackground property until a patch is available.

Exploit

Fix

DoS

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2015-1610

ALT-PU-2015-1616

BDU:2015-10796

BDU:2015-10797

CVE-2015-5122

MGASA-2015-0275

RHSA-2015:1235

RHSA-2015_1235

SUSE-SU-2015:1255-1

SUSE-SU-2015:1258-1

SUSE-SU-2015_1255-1

SUSE-SU-2015_1258-1

Affected Products

Alt Linux

Flash Player

Red Hat

Suse

References · 45

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_opaque_background_uaf.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/132663/Adobe-Flash-opaqueBackground-Use-After-Free.html · Exploit
• 🔥 https://exploit-db.com/exploits/37599 · Exploit
• https://helpx.adobe.com/security/products/flash-player/apsb15-18.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html · Vendor Advisory
• https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0275.html · Security Note
• https://bdu.fstec.ru/vul/2015-10796 · Security Note
• http://rhn.redhat.com/errata/RHSA-2015-1235.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0275 · Vendor Advisory
• https://helpx.adobe.com/security/products/flash-player/apsa15-04.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10797 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html · Vendor Advisory
• https://security.gentoo.org/glsa/201508-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5122 · Security Note