CVE-2015-3113
9.8 · CRITICALActively ExploitedHeap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute ar…
Overview
CVE-2015-3113 is a critical-severity vulnerability affecting adobe flash_player. It was published on June 23, 2015 and has a CVSS 3.1 base score of 9.8 (CRITICAL). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical description
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.
Remediation
Check the references section for vendor advisories and patches from adobe. Update flash_player to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected products
| Vendor | Product | Versions | Status |
|---|---|---|---|
| adobe | flash_player | >= 0, < 13.0.0.296 | Affected |
| hp | insight_orchestration | >= 0, < 7.5.0 | Affected |
| hp | system_management_homepage | >= 0, < 7.5.0 | Affected |
| hp | systems_insight_manager | >= 0, < 7.5 | Affected |
| hp | version_control_agent | >= 0, < 7.5.0 | Affected |
| hp | version_control_repository_manager | >= 0, < 7.5.0 | Affected |
| hp | virtual_connect_enterprise_manager | >= 0, < 7.5.0 | Affected |
References
How CyberStrike helps
Reason, not just scan
It reasons through your app's logic the way a human pentester would, so it finds flaws signature scanners miss.
Learn moreVerified findings
Every finding is proven exploitable before you see it, which cuts the false positives that bury real risk.
Learn moreAI-driven DAST and SAST
Probe running apps and read source from one engine, so issues are caught before and after they ship.
Learn moreOpen source
Read exactly how it tests and what it reports. CyberStrike is open source and in early access.
View the repo
Frequently asked questions
What is CVE-2015-3113?
CVE-2015-3113 is a critical-severity vulnerability affecting adobe flash_player. It was published on June 23, 2015 and has a CVSS 3.1 base score of 9.8 (CRITICAL). This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild.
How severe is CVE-2015-3113?
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2015-3113?
Check the references section for vendor advisories and patches from adobe. Update flash_player to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2015-3113?
CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2015-3113 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.
Related CRITICAL CVEs from 2015
View all- 10.0CVE-2015-3306
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files vi
View details - 10.0CVE-2015-0987
Omron CX-One CX-Programmer before 9.6, CJ2M PLC devices before 2.1, and CJ2H PLC devices before 1.5
View details - 10.0CVE-2015-8104
The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS us
View details - 10.0CVE-2015-7919
SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently ca
View details - 10.0CVE-2015-8267
The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dov
View details - 10.0CVE-2015-7930
Adcon Telemetry A840 Telemetry Gateway Base Station has hardcoded credentials, which allows remote a
View details - 10.0CVE-2015-8459
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and bef
View details - 9.9CVE-2015-7926
eWON devices with firmware before 10.1s0 omit RBAC for I/O server information and status requests, w
View details - 9.8CVE-2015-0311
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through
View details - 9.8CVE-2015-0313
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16
View details - 9.8CVE-2015-1427
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attac
View details - 9.8CVE-2015-1635
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows
View details