High severity · published Jan 23, 2015
CVE-2015-0310
Adobe Flash Player ASLR Bypass Vulnerability
In wildKEV
7.8
CVSS
15.1%
EPSS
Yes
On KEV
Description
Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)15.1% · higher than 97% of CVEs
Exploited in the wildYes
CISA KEVListed May 25, 2022
Federal remediation dueJun 15, 2022
Ransomware campaign useNot known
Affected products
Which versions
FP
Flash Player · Adobe
before 11.2.202.438; before 13.0.0.262; 14.0 before 16.0.0.287 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-0310
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-0310
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
vendor-advisory
http://security.gentoo.org/glsa/glsa-201502-02.xml
vdb-entry
http://www.securityfocus.com/bid/72261
third-party-advisory
http://secunia.com/advisories/62660
third-party-advisory
http://secunia.com/advisories/62740
vdb-entry
http://www.securitytracker.com/id/1031609
x_refsource_CONFIRM
http://helpx.adobe.com/security/products/flash-player/apsb15-02.html
More from Flash Player
9.8
CVE-2016-4171
Adobe Flash Player Remote Code Execution Vulnerability
9.8
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2016-1019
Adobe Flash Player Arbitrary Code Execution Vulnerability
9.8
CVE-2015-5123
Adobe Flash Player Use-After-Free Vulnerability
9.8
CVE-2015-5122
Adobe Flash Player Use-After-Free Vulnerability