CVE-2015-0313

Published: Feb 2, 2015Modified: Apr 21, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.

Affected (12)

Products: Adobe: Flash Player · Opensuse: Evergreen, Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Workstation Extension · +1 more

Show all products

Adobe: Flash Player · Opensuse: Evergreen, Opensuse · Suse: Linux Enterprise Desktop, Linux Enterprise Workstation Extension · Microsoft: Internet Explorer, Edge

1 product

2 products

2 products

Linux Enterprise Desktop

Linux Enterprise Workstation Extension

Microsoft

2 products

Internet Explorer

Edge

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Adobe Flash Player	Before 11.2.202.442

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Configuration B

2 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Adobe Flash Player	Before 13.0.0.269
Adobe Flash Player	From 14.0.0.125 to 16.0.0.305

Running on/with	Platform Versions
Apple Mac Os X	All versions
Microsoft Windows	All versions

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Opensuse Evergreen	Version 11.4
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2
Suse Linux Enterprise Desktop	Version 11 sp3
Suse Linux Enterprise Desktop	Version 12
Suse Linux Enterprise Workstation Extension	Version 12

Configuration D

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft Internet Explorer	Version 10

Running on/with	Platform Versions
Microsoft Windows 8	All versions
Microsoft Windows Rt	All versions
Microsoft Windows Server 2012	All versions

Configuration E

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft Internet Explorer	Version 11

Running on/with	Platform Versions
Microsoft Windows 8.1	All versions
Microsoft Windows Rt 8.1	All versions
Microsoft Windows Server 2012	Version r2

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Edge	All versions

Running on/with	Platform Versions
Microsoft Windows 10 1507	All versions

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (34)

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html

Source: psirt@adobe.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html

Source: psirt@adobe.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html

Source: psirt@adobe.com

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00009.html

Source: psirt@adobe.com

Mailing ListThird Party Advisory

http://packetstormsecurity.com/files/131189/Adobe-Flash-Player-ByteArray-With-Workers-Use-After-Free.html

Source: psirt@adobe.com

ExploitThird Party AdvisoryVDB Entry

http://secunia.com/advisories/62528

Source: psirt@adobe.com

Broken Link

http://secunia.com/advisories/62777

Source: psirt@adobe.com

Broken Link

http://secunia.com/advisories/62895

Source: psirt@adobe.com

Broken Link

http://www.osvdb.org/117853

Source: psirt@adobe.com

Broken Link

http://www.securityfocus.com/bid/72429

Source: psirt@adobe.com

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1031686

Source: psirt@adobe.com

Broken LinkThird Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/100641

Source: psirt@adobe.com

Third Party AdvisoryVDB Entry

https://helpx.adobe.com/security/products/flash-player/apsa15-02.html

Source: psirt@adobe.com

Vendor Advisory

https://helpx.adobe.com/security/products/flash-player/apsb15-04.html

Source: psirt@adobe.com

Broken Link

https://technet.microsoft.com/library/security/2755801

Source: psirt@adobe.com

PatchVendor Advisory

https://www.exploit-db.com/exploits/36579/

Source: psirt@adobe.com

ExploitThird Party AdvisoryVDB Entry

http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html