CVE-2015-0359

EXPLOITED

Adobe Flash Player domainMemory ByteArray Use After Free

Title source: metasploit

Description

Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0346.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotewindows

https://www.exploit-db.com/exploits/36956

View Code ZIP pw:eip

metasploit WORKING POC GREAT

by bilou, Unknown, hdarwin, juan vazquez · rubypocwin

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_domain_memory_uaf.rb

View Code ZIP pw:eip

References (9)

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00012.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html

[Vendor Advisory] http://rhn.redhat.com/errata/RHSA-2015-0813.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1032105

[Patch, Vendor Advisory] https://helpx.adobe.com/security/products/flash-player/apsb15-06.html

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/74067

[Third Party Advisory] https://security.gentoo.org/glsa/201504-07

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00011.html

Scores

EPSS 0.8856

EPSS Percentile 99.5%

Details

VulnCheck KEV 2015-11-09

Status published

Products (16)

adobe/flash_player 14.0.0.125

adobe/flash_player 14.0.0.145

adobe/flash_player 14.0.0.176

adobe/flash_player 14.0.0.179

adobe/flash_player 15.0.0.152

adobe/flash_player 15.0.0.167

adobe/flash_player 15.0.0.189

adobe/flash_player 15.0.0.223

adobe/flash_player 15.0.0.239

adobe/flash_player 15.0.0.246

... and 6 more

Published Apr 14, 2015

Tracked Since Feb 18, 2026