CVE-2015-5119
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
Analysis
Adobe Flash Player contains a use-after-free in the ByteArray AS3 class that allows remote code execution, infamously leaked from the Hacking Team breach in July 2015 and immediately adopted by multiple exploit kits and APT groups.
Technical Context
The CWE-416 use-after-free occurs in the ByteArray class when a custom valueOf() handler triggers garbage collection during a comparison operation. The ByteArray's backing buffer is freed while still referenced, allowing the attacker to reallocate the freed memory with controlled data for arbitrary read/write primitives.
Affected Products
['Adobe Flash Player 13.x through 13.0.0.296 (Windows/OS X)', 'Adobe Flash Player 14.x through 18.0.0.194 (Windows/OS X)', 'Adobe Flash Player 11.x through 11.2.202.468 (Linux)']
Remediation
Flash Player is end-of-life and must be removed. This exploit was a major catalyst for the industry-wide effort to deprecate Flash. Ensure no Flash Player remnants exist on any systems.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today