{"id":"CVE-2015-0359","published":"2015-04-14T22:00:00Z","modified":"2024-08-06T04:10:09Z","title":"Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0346.","provenance":"source","from":"CVE.org"},"summary":{"text":"A double free vulnerability in Adobe Flash Player allows attackers to execute arbitrary code via unspecified vectors. It affects Windows, OS X, and Linux users running versions before the specified fixed releases.","provenance":"ai","model":"deepseek-v4-flash","generatedAt":"2026-10-23T03:20:09Z"},"cvss":null,"epss":{"score":0.92109,"percentile":0.9982,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2015-11-09","exploitedFirstSeen":"2015-11-09","ransomware":false,"evidence":[{"url":"https://www.recordedfuture.com/blog/top-vulnerabilities-2015","date":"2015-11-09"},{"url":"https://securelist.com/kaspersky-security-bulletin-2015-overall-statistics-for-2015/73038/","date":"2015-12-15"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":12,"pulses":[{"name":"2015: Malware Analysis Report","url":"https://otx.alienvault.com/pulse/69f4dfa6405cf7858f1b732a","created":"2026-05-01"},{"name":"TrojanDownloader:Win32/Tsunovest.A","url":"https://otx.alienvault.com/pulse/67c659b2331a0c096ff6f026","created":"2025-03-04"},{"name":"Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows","url":"https://otx.alienvault.com/pulse/666ac558d08da6cfb3ba135b","created":"2024-06-13"},{"name":"Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'","url":"https://otx.alienvault.com/pulse/6668b85065eec626e4766a38","created":"2024-06-11"},{"name":"Log4j","url":"https://otx.alienvault.com/pulse/61df005d9f0ff216afd15bdc","created":"2022-01-12"},{"name":"Ransomware: Night Sky","url":"https://otx.alienvault.com/pulse/61deff0101737ee62817cbd7","created":"2022-01-12"},{"name":"Angler, Nuclear Exploit Kits Integrate Pawn Storm Flash Exploit","url":"https://otx.alienvault.com/pulse/5638f0af4637f2388aaec770","created":"2015-11-03"},{"name":"Sundown EK Spreads LuminosityLink RAT","url":"https://otx.alienvault.com/pulse/558d7f32b45ff55a1225e6f3","created":"2015-06-26"},{"name":"AV Labs: Sundown Exploit Kit Indicators","url":"https://otx.alienvault.com/pulse/558ade59b45ff518da25e72a","created":"2015-06-24"},{"name":"Angler EK Exploiting Adobe Flash CVE-2015-3090","url":"https://otx.alienvault.com/pulse/55653b1ab45ff54c8ee5b42c","created":"2015-05-27"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://security.gentoo.org/glsa/201504-07","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://www.securitytracker.com/id/1032105","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0813.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-06.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/74067","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unspecified vectors suggest drive-by or malicious content delivery","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows attackers to execute arbitrary code via unspecified vectors","start":159,"end":225}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Flash content triggers memory corruption and arbitrary code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Double free vulnerability in Adobe Flash Player before 13.0.0.281","start":0,"end":65}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"Addressed by Exploit kit(s)\r\nCVE-2015-0310 Adobe Flash Player APSB15-02 Angler (JS/Axpergle)\r\nCVE-2015-0311 Adobe Flash Player APSB15-03 Angler\r\nCVE-2015-0313 Adobe Flash Player APSB15-04 Angler\r\nCVE-2015-0336 Adobe Flash Player APSB15-05 Nuclear (JS/Neclu); Angler\r\nCVE-2015-0359 Adobe Flash Player APSB15-06","start":81622,"end":81931},{"quote":"CVE-2014-8439, CVE-2015-0311, CVE-2015-0313, and CVE-2015-0359;","start":93043,"end":93106},{"quote":" CVE-2015-0359, a double free vulnerability, was first disclosed in April 2015","start":93417,"end":93496},{"quote":"CVE-2015-0359","start":94090,"end":94103},{"quote":"47, 49\r\nCVE-2013-2460, 46\r\nCVE-2013-2551, 46, 54\r\nCVE-2013-7331, 54\r\nCVE-2014-0322, 54\r\nCVE-2014-0497, 53\r\nCVE-2014-0515, 53\r\nCVE-2014-6332, 43, 44, 50\r\nCVE-2014-8439, 46, 53\r\nCVE-2015-0097, 57\r\nCVE-2015-0310, 47\r\nCVE-2015-0311, 46, 47, 53\r\nCVE-2015-0313, 46, 47, 53\r\nCVE-2015-0336, 47, 53\r\nCVE-2015-0359, 47,","start":238202,"end":238511}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-0372","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-0372","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":36956,"url":"https://www.exploit-db.com/exploits/36956","title":"Adobe Flash Player - domainMemory ByteArray Use-After-Free (Metasploit)","type":"remote","platform":"windows","date":"2015-05-08","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-05-08"},"metasploit":[{"name":"Adobe Flash Player domainMemory ByteArray Use After Free","module":"exploit/windows/browser/adobe_flash_domain_memory_uaf","type":"exploit","disclosureDate":"2014-04-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_domain_memory_uaf.rb"}],"first":{"date":"2014-04-14","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_domain_memory_uaf.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"}],"timeline":[{"date":"2014-04-14","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2015-05-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_domain_memory_uaf.rb","provenance":"source"},{"date":"2015-04-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2015-0359","provenance":"source"},{"date":"2015-11-09","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.recordedfuture.com/blog/top-vulnerabilities-2015","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":66.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4007 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9982"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.53,"detail":"12 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}