CVE-2015-8651

HIGH KEV RANSOMWARE

Adobe Flash Player < 18.0.0.324, 19.x-20.x < 20.0.0.267, AIR < 20.0.0.233 - Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2015-8651 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added May 25, 2022, with confirmed use in ransomware campaigns.

Description

Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

References (13)

Core 13
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00048.html
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034544
Third Party Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2697.html
Not Applicable, Patch, Vendor Advisory x_refsource_confirm
https://helpx.adobe.com/security/products/flash-player/apsb16-01.html
Broken Link, Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/79705
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00046.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00047.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00045.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201601-03

Scores

CVSS v3 8.8
EPSS 0.6770
EPSS Percentile 99.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2022-05-25
VulnCheck KEV 2015-12-28
InTheWild.io 2015-12-28
ENISA EUVD EUVD-2015-8528
Ransomware Use Confirmed
CWE
CWE-190
Status published
Products (22)
adobe/air < 20.0.0.233
adobe/air_sdk < 20.0.0.233
adobe/air_sdk_\&_compiler < 20.0.0.233
adobe/flash_player < 11.2.202.559
hp/insight_control < 7.6
hp/insight_control_server_provisioning < 7.6
hp/matrix_operating_environment 7.6
hp/system_management_homepage < 7.6
hp/systems_insight_manager < 7.6
hp/version_control_repository_manager < 7.6
... and 12 more
Published Dec 28, 2015
KEV Added May 25, 2022
Tracked Since Feb 18, 2026