What’s Vulnerable › Vulnerabilities

CVE-2015-0311: Adobe Flash Player Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-04-13
• EPSS: 85.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-01-23 · updated 2026-06-17

Description

Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.

Affected products

• Adobe Flash Player 24.0.0.186 and earlier.: through 11.2.202.438; through 13.0.0.262; from 14.0.0.125 before 16.0.0.287 — fixed in 16.0.0.287
• Microsoft Edge: all versions
• Microsoft Internet Explorer 11: 10, 11
• SUSE Linux Enterprise Server 15 SP1: 11-sp3, 12
• SUSE Linux Enterprise Workstation Extension: 12

How to fix

Upgrade to a fixed version: Adobe Flash Player 24.0.0.186 and earlier. 16.0.0.287. Check the vendor advisory for mitigations.

References

• http://helpx.adobe.com/security/products/flash-player/apsa15-01.html
• http://helpx.adobe.com/security/products/flash-player/apsb15-03.html
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00031.html
• http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html
• http://secunia.com/advisories/62432
• http://secunia.com/advisories/62543
• http://secunia.com/advisories/62650
• http://secunia.com/advisories/62660
• http://secunia.com/advisories/62740
• http://security.gentoo.org/glsa/glsa-201502-02.xml
• http://www.securityfocus.com/bid/72283

Get alerted when CVE-2015-0311 or the next vulnerability affects your stack