What’s Vulnerable › Vulnerabilities

CVE-2015-0313: Adobe Flash Player Use-After-Free Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-04-13
• EPSS: 95.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-02-02 · updated 2026-06-17
• Weakness: CWE-416

Description

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.

Affected products

• Adobe Flash Player 24.0.0.186 and earlier.: before 11.2.202.442; before 13.0.0.269; from 14.0.0.125 before 16.0.0.305 — fixed in 11.2.202.442, 13.0.0.269, 16.0.0.305
• Microsoft Edge: all versions
• Microsoft Internet Explorer 11: 10, 11
• openSUSE Evergreen: 11.4
• Opensuse: 13.1, 13.2
• SUSE Linux Enterprise Server 15 SP1: 11-sp3, 12
• SUSE Linux Enterprise Workstation Extension: 12

How to fix

Upgrade to a fixed version: Adobe Flash Player 24.0.0.186 and earlier. 11.2.202.442, 13.0.0.269, 16.0.0.305. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html
• http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00009.html
• http://packetstormsecurity.com/files/131189/Adobe-Flash-Player-ByteArray-With-Workers-Use-After-Free.html
• http://secunia.com/advisories/62528
• http://secunia.com/advisories/62777
• http://secunia.com/advisories/62895
• http://www.osvdb.org/117853
• http://www.securityfocus.com/bid/72429
• http://www.securitytracker.com/id/1031686
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100641

Get alerted when CVE-2015-0313 or the next vulnerability affects your stack