CVE-2015-5122
Quick assessment
Affected
n/a n/a
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Adobe Flash Player是美国奥多比（Adobe）公司的一款跨平台、基于浏览器的多媒体播放器产品。该产品支持跨屏幕和浏览器查看应用程序、内容和视频。ActionScript 3（AS3）是Adobe为其Flash产品开发的一种面向对象的编程语言。 Adobe Flash Player的AS3实现过程中的DisplayObject类存在释放后重用漏洞。远程攻击者可借助特制的Flash内容利用该漏洞执行任意代码，或造成拒绝服务（内存损坏）。以下版本受到影响：基于Windows和OS X平台的Ado
Public Exploits 2
ExploitDB · 1
EDB-37599 [remote]
Metasploit · 1
adobe_flash_opaque_background_uaf.rb [exploit]
In-the-Wild Activity Observed
cisa_kev · confirmed
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2015-5122
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Adobe Flash Player ActionScript 3 释放后重用漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Adobe Flash Player是美国奥多比（Adobe）公司的一款跨平台、基于浏览器的多媒体播放器产品。该产品支持跨屏幕和浏览器查看应用程序、内容和视频。ActionScript 3（AS3）是Adobe为其Flash产品开发的一种面向对象的编程语言。 Adobe Flash Player的AS3实现过程中的DisplayObject类存在释放后重用漏洞。远程攻击者可借助特制的Flash内容利用该漏洞执行任意代码，或造成拒绝服务（内存损坏）。以下版本受到影响：基于Windows和OS X平台的Ado
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2015-5122
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2015-5122
请登录查看更多情报信息。
Vendor Advisories for CVE-2015-5122 (8)
-
https://helpx.adobe.com/security/products/flash-player/apsa15-04.html x_refsource_CONFIRM
-
https://helpx.adobe.com/security/products/flash-player/apsb15-18.html x_refsource_CONFIRM
-
-
-
-
🔗 VU#338736 - Adobe Flash ActionScript 3 opaqueBackground use-after-free vulnerability Read full article third-party-advisory x_refsource_CERT-VN
-
-
Exploits & Public PoCs for CVE-2015-5122 (2)
Proof of Concept for CVE-2015-5122 (1)
Mailing List Discussions for CVE-2015-5122 (4)
-
🔗 '[security bulletin] HPSBMU03409 rev.1 - HP Matrix Operating Environment, Multiple Vulnerabilities' - MARC Read full article vendor-advisory x_refsource_HP
-
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html vendor-advisory x_refsource_SUSE
Security Blog Posts for CVE-2015-5122 (1)
Other References for CVE-2015-5122 (4)
-
https://perception-point.io/new/breaking-cfi.php x_refsource_MISC
-
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784 vendor-advisory x_refsource_HP
Same Patch Batch · n/a · 2015-07-14 · 88 CVEs total
| CVE-2015-2419 | Microsoft Internet Explorer JScript 内存损坏漏洞 | |
| CVE-2015-2413 | Microsoft Internet Explorer 信息泄露漏洞 | |
| CVE-2015-2414 | Microsoft Internet Explorer 信息泄露漏洞 | |
| CVE-2015-2412 | Microsoft Internet Explorer 信息泄露漏洞 | |
| CVE-2015-2408 | Microsoft Internet Explorer 内存损坏漏洞 | |
| CVE-2015-2406 | Microsoft Internet Explorer 内存损坏漏洞 | |
| CVE-2015-2404 | Microsoft Internet Explorer 内存损坏漏洞 | |
| CVE-2015-2403 | Microsoft Internet Explorer 内存损坏漏洞 | |
| CVE-2015-2402 | Microsoft Internet Explorer 特权提升漏洞 | |
| CVE-2015-2410 | Microsoft Internet Explorer 信息泄露漏洞 | |
| CVE-2015-2415 | Microsoft Office 内存损坏漏洞 | |
| CVE-2015-2421 | Microsoft Internet Explorer ASLR绕过漏洞 | |
| CVE-2015-2422 | Microsoft Internet Explorer 内存损坏漏洞 | |
| CVE-2015-2424 | Microsoft Office 内存损坏漏洞 | |
| CVE-2015-2425 | Microsoft Internet Explorer 内存损坏漏洞 | |
| CVE-2015-1927 | IBM WebSphere Application Server 权限许可和访问控制漏洞 | |
| CVE-2015-1936 | IBM WebSphere Application Server 会话劫持漏洞 | |
| CVE-2015-1946 | IBM WebSphere Application Server和WebSphere Virtual Enterprise 权限许可和访问控制漏洞 | |
| CVE-2015-3007 | Juniper Networks SRX Series 安全漏洞 | |
| CVE-2015-4268 | Cisco Identity Services Engine Infra Admin UI 跨站脚本漏洞 |
Showing top 20 of 88 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2015-5122
No comments yet