CVE-2015-5122

adobe flash player, adobe flash player desktop runtime, redhat enterprise linux desktop

Published 14 Jul 2015 · updated 17 Jun 2026 · Analyzed

9.8 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 13 Apr 2022, with a remediation deadline of 4 May 2022 for US federal agencies.

Required action: The impacted product is end-of-life and should be disconnected if still in use.

Description

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

References

lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html · Mailing List, Third Party Advisory
marc.info/?l=bugtraq&m=144050155601375&w=2 · Mailing List, Third Party Advisory
packetstormsecurity.com/files/132663/Adobe-Flash-opaqueBackground-Use-After-Free.html · Exploit, Third Party Advisory, VDB Entry
rhn.redhat.com/errata/RHSA-2015-1235.html · Third Party Advisory
www.kb.cert.org/vuls/id/338736 · Third Party Advisory, US Government Resource
www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_opaque_background_uaf · Third Party Advisory
www.securityfocus.com/bid/75712 · Broken Link, Third Party Advisory, VDB Entry
www.securitytracker.com/id/1032890 · Broken Link, Third Party Advisory, VDB Entry
www.us-cert.gov/ncas/alerts/TA15-195A · Third Party Advisory, US Government Resource
h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784 · Broken Link, Third Party Advisory
h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467 · Third Party Advisory
helpx.adobe.com/security/products/flash-player/apsa15-04.html · Broken Link, Vendor Advisory
helpx.adobe.com/security/products/flash-player/apsb15-18.html · Broken Link, Vendor Advisory
perception-point.io/2018/04/11/breaking-cfi-cve-2015-5122-coop/ · Broken Link, Third Party Advisory
perception-point.io/new/breaking-cfi.php · Broken Link, Third Party Advisory
security.gentoo.org/glsa/201508-01 · Third Party Advisory
www.exploit-db.com/exploits/37599/ · Exploit, Third Party Advisory, VDB Entry
www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html · Broken Link, Third Party Advisory
github.com/cisagov/vulnrichment/issues/196 · Issue Tracking
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5122 · US Government Resource