CVE-2015-5122

KEVAdobe Flash Player Use-After-Free Vulnerability

Description

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedJul 14, 2015

Last modifiedJun 17, 2026

Added to KEVApr 13, 2022

Remediation dueMay 4, 2022

References

lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.htmlMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.htmlMailing ListThird Party Advisory
marc.info/?l=bugtraq&m=144050155601375&w=2Mailing ListThird Party Advisory
packetstormsecurity.com/files/132663/Adobe-Flash-opaqueBackground-Use-After-Free.htmlExploitThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-1235.htmlThird Party Advisory
kb.cert.org/vuls/id/338736Third Party AdvisoryUS Government Resource
rapid7.com/db/modules/exploit/multi/browser/adobe_flash_opaque_background_uafThird Party Advisory
securityfocus.com/bid/75712Broken LinkThird Party Advisory
securitytracker.com/id/1032890Broken LinkThird Party Advisory
us-cert.gov/ncas/alerts/TA15-195AThird Party AdvisoryUS Government Resource
h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784Broken LinkThird Party Advisory

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1636 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 87.0% · top 1% of all CVEs
Weakness: CWE-416
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.The impacted product is end-of-life and should be disconnected if still in use.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.