CVE-2015-5123
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-in-adobe-flash-emerges-from-hacking-team-leak/Broken LinkThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.htmlMailing ListThird Party Advisory
- marc.info/?l=bugtraq&m=144050155601375&w=2Mailing ListThird Party Advisory
- rhn.redhat.com/errata/RHSA-2015-1235.htmlThird Party Advisory
- kb.cert.org/vuls/id/918568Third Party AdvisoryUS Government Resource
- securityfocus.com/bid/75710Broken LinkThird Party Advisory
- securitytracker.com/id/1032890Broken LinkThird Party Advisory
- us-cert.gov/ncas/alerts/TA15-195AThird Party AdvisoryUS Government Resource
- h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784Broken LinkThird Party Advisory
- helpx.adobe.com/security/products/flash-player/apsa15-04.htmlBroken LinkVendor Advisory
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1637 days
- CVSS
- 9.8 CRITICAL
- EPSS (30-day exploit probability)
- 18.8% · top 3% of all CVEs
- Weakness
- CWE-416
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.The impacted product is end-of-life and should be disconnected if still in use.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.