CVE-2015-3113

CRITICAL KEV

Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow

Title source: metasploit

Description

Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in June 2015.

Exploits (2)

metasploit WORKING POC GREAT
by Unknown, juan vazquez · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_nellymoser_bof.rb
exploitdb WORKING POC VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/37536

References (15)

Scores

CVSS v3 9.8
EPSS 0.9242
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Intel

CISA KEV 2022-04-13
VulnCheck KEV 2015-06-23
InTheWild.io 2015-06-23
ENISA EUVD EUVD-2015-3194

Classification

CWE
CWE-122 CWE-787
Status draft

Affected Products (17)

adobe/flash_player < 13.0.0.296
opensuse/evergreen
opensuse/opensuse
opensuse/opensuse
suse/linux_enterprise_desktop
suse/linux_enterprise_workstation_extension
hp/insight_orchestration < 7.5.0
hp/system_management_homepage < 7.5.0
hp/systems_insight_manager < 7.5
hp/version_control_agent < 7.5.0
hp/version_control_repository_manager < 7.5.0
hp/version_control_repository_manager
hp/virtual_connect_enterprise_manager < 7.5.0
redhat/enterprise_linux_desktop
redhat/enterprise_linux_eus
... and 2 more

Timeline

Published Jun 23, 2015
KEV Added Apr 13, 2022
Tracked Since Feb 18, 2026