CVE-2015-0313

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-0313
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2015, a different vulnerability than CVE-2015-0315, CVE-2015-0320, and CVE-2015-0322.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00009.html Mailing List Third Party Advisory
http://packetstormsecurity.com/files/131189/Adobe-Flash-Player-ByteArray-With-Workers-Use-After-Free.html Exploit Third Party Advisory VDB Entry
http://secunia.com/advisories/62528 Broken Link
http://secunia.com/advisories/62777 Broken Link
http://secunia.com/advisories/62895 Broken Link
http://www.osvdb.org/117853 Broken Link
http://www.securityfocus.com/bid/72429 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1031686 Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/100641 Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/flash-player/apsa15-02.html Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb15-04.html Broken Link
https://technet.microsoft.com/library/security/2755801 Patch Vendor Advisory
https://www.exploit-db.com/exploits/36579/ Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*
OR cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*
History

02 Jul 2024, 17:41

Type Values Removed Values Added
CVSS v2 : 10.0
v3 : unknown 		v2 : 10.0
v3 : 9.8
References () http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html - () http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00006.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html - () http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00007.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html - () http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00008.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00009.html - () http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00009.html - Mailing List, Third Party Advisory
References () http://packetstormsecurity.com/files/131189/Adobe-Flash-Player-ByteArray-With-Workers-Use-After-Free.html - () http://packetstormsecurity.com/files/131189/Adobe-Flash-Player-ByteArray-With-Workers-Use-After-Free.html - Exploit, Third Party Advisory, VDB Entry
References () http://secunia.com/advisories/62528 - () http://secunia.com/advisories/62528 - Broken Link
References () http://secunia.com/advisories/62777 - () http://secunia.com/advisories/62777 - Broken Link
References () http://secunia.com/advisories/62895 - () http://secunia.com/advisories/62895 - Broken Link
References () http://www.osvdb.org/117853 - () http://www.osvdb.org/117853 - Broken Link
References () http://www.securityfocus.com/bid/72429 - () http://www.securityfocus.com/bid/72429 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1031686 - () http://www.securitytracker.com/id/1031686 - Broken Link, Third Party Advisory, VDB Entry
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/100641 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/100641 - Third Party Advisory, VDB Entry
References () https://helpx.adobe.com/security/products/flash-player/apsb15-04.html - () https://helpx.adobe.com/security/products/flash-player/apsb15-04.html - Broken Link
References () https://technet.microsoft.com/library/security/2755801 - () https://technet.microsoft.com/library/security/2755801 - Patch, Vendor Advisory
References () https://www.exploit-db.com/exploits/36579/ - () https://www.exploit-db.com/exploits/36579/ - Exploit, Third Party Advisory, VDB Entry
First Time Suse linux Enterprise Desktop
Microsoft windows 8.1
Opensuse
Microsoft windows 10 1507
Microsoft windows Rt 8.1
Microsoft windows Rt
Microsoft internet Explorer
Microsoft windows 8
Opensuse opensuse
Microsoft windows Server 2012
Suse
Microsoft edge
Suse linux Enterprise Workstation Extension
Opensuse evergreen
CPE cpe:2.3:a:adobe:flash_player:16.0.0.257:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.223:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.235:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.152:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.287:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.246:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:16.0.0.296:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.176:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.189:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.167:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:15.0.0.239:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:14.0.0.179:*:*:*:*:*:*:*		 cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8:-:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:12:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt:-:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
CWE NVD-CWE-noinfo CWE-416
Information

Published : 2015-02-02 19:59

Updated : 2024-07-02 17:41

NVD link : CVE-2015-0313

Mitre link : CVE-2015-0313

CVE.ORG link : CVE-2015-0313

JSON object : View

Products Affected

microsoft

  • windows
  • windows_8
  • windows_server_2012
  • windows_8.1
  • windows_10_1507
  • edge
  • internet_explorer
  • windows_rt
  • windows_rt_8.1

opensuse

  • opensuse
  • evergreen

suse

  • linux_enterprise_workstation_extension
  • linux_enterprise_desktop

linux

  • linux_kernel

apple

  • mac_os_x

adobe

  • flash_player
CWE
CWE-416

Use After Free