CVEs / CVE-2015-3043
CVE-2015-3043: Adobe Flash Player Memory Corruption Vulnerability
- Known exploited in the CISA KEV catalog since 3 Mar 2022
- critical 9.8 CVSS 3.1 (NVD)
- EPSS 73.8% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2015-3043
Summary
A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.
Description
Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | n/a | — |
Exploitation
| In CISA KEV since | 3 Mar 2022 |
|---|---|
| Due date for US federal agencies | 24 Mar 2022 |
| Used in ransomware campaigns | Unknown |
| Required action | The impacted product is end-of-life and should be disconnected if still in use. |
Severity
| CVSS 3.1 | 9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-787 |
References
- CVE-2015-3043 on NVD
- CVE-2015-3043 in the CISA KEV catalog
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00011.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00012.html Mailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html Mailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0813.html Third Party Advisory
- http://www.securityfocus.com/bid/74062 Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1032105 Broken Link, Third Party Advisory, VDB Entry
- https://helpx.adobe.com/security/products/flash-player/apsb15-06.html Broken Link, Patch, Vendor Advisory
- https://security.gentoo.org/glsa/201504-07 Third Party Advisory
- https://www.exploit-db.com/exploits/37536/ Exploit, Third Party Advisory, VDB Entry
- https://github.com/cisagov/vulnrichment/issues/196 Issue Tracking
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3043 US Government Resource
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.