CVE-2015-0311

CRITICAL KEV RANSOMWARE

Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free

Title source: metasploit

Description

Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015.

Exploits (4)

nomisec WRITEUP
by jr64 · local
https://github.com/jr64/CVE-2015-0311
github NO CODE
by d0now · angelscriptpoc
https://github.com/d0now/flash-cve-exploits/tree/master/cve-2015-0311.as
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotewindows
https://www.exploit-db.com/exploits/36360
metasploit WORKING POC GREAT
by Unknown, hdarwin, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_uncompress_zlib_uaf.rb

References (16)

Scores

CVSS v3 9.8
EPSS 0.9284
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Intel

CISA KEV 2022-04-13
VulnCheck KEV 2015-01-20
InTheWild.io 2015-01-20
ENISA EUVD EUVD-2015-0324
Ransomware Use Confirmed

Classification

Status draft

Affected Products (7)

adobe/flash_player < 11.2.202.438
suse/linux_enterprise_desktop
suse/linux_enterprise_desktop
suse/linux_enterprise_workstation_extension
microsoft/internet_explorer
microsoft/internet_explorer
microsoft/edge

Timeline

Published Jan 23, 2015
KEV Added Apr 13, 2022
Tracked Since Feb 18, 2026