What’s Vulnerable › Vulnerabilities

CVE-2015-3113: Adobe Flash Player Heap-Based Buffer Overflow Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-04-13
• EPSS: 99.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-06-23 · updated 2026-06-17
• Weakness: CWE-787

Description

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

Affected products

• Adobe Flash Player 24.0.0.186 and earlier.: before 13.0.0.296; from 14.0.0.125 before 18.0.0.194; before 11.2.202.468 — fixed in 11.2.202.468, 13.0.0.296, 18.0.0.194
• HP Insight Orchestration: before 7.5.0 — fixed in 7.5.0
• Hewlett Packard Enterprise System Management Homepage for Windows and Linux: before 7.5.0 — fixed in 7.5.0
• Hewlett Packard Enterprise Systems Insight Manager using OpenSSL: before 7.5 — fixed in 7.5
• HP Version Control Agent: before 7.5.0 — fixed in 7.5.0
• Hewlett Packard Enterprise Version Control Repository Manager (VCRM): before 7.5.0; 7.6 — fixed in 7.5.0
• HP Virtual Connect Enterprise Manager: before 7.5.0 — fixed in 7.5.0
• openSUSE Evergreen: 11.4
• Opensuse: 13.1, 13.2
• RedHat Enterprise Linux Desktop: 6.0
• RedHat Enterprise Linux Eus: 6.6
• RedHat Enterprise Linux Server: 6.0
• RedHat Enterprise Linux Workstation: 6.0
• SUSE Linux Enterprise Server 15 SP1: 12
• SUSE Linux Enterprise Workstation Extension: 12

How to fix

Upgrade to a fixed version: Adobe Flash Player 24.0.0.186 and earlier. 11.2.202.468, 13.0.0.296, 18.0.0.194; HP Insight Orchestration 7.5.0; Hewlett Packard Enterprise System Management Homepage for Windows and Linux 7.5.0; Hewlett Packard Enterprise Systems Insight Manager using OpenSSL 7.5; HP Version Control Agent 7.5.0; Hewlett Packard Enterprise Version Control Repository Manager (VCRM) 7.5.0; HP Virtual Connect Enterprise Manager 7.5.0. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.html
• http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.html
• http://marc.info/?l=bugtraq&m=144050155601375&w=2
• http://rhn.redhat.com/errata/RHSA-2015-1184.html
• http://www.securityfocus.com/bid/75371
• http://www.securitytracker.com/id/1032696
• https://bugzilla.redhat.com/show_bug.cgi?id=1235036
• https://bugzilla.suse.com/show_bug.cgi?id=935701
• https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467
• https://helpx.adobe.com/security/products/flash-player/apsb15-14.html
• https://security.gentoo.org/glsa/201507-13

Get alerted when CVE-2015-3113 or the next vulnerability affects your stack