{"id":"CVE-2015-3105","published":"2015-06-10T01:00:00Z","modified":"2024-08-06T05:39:31Z","title":"Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a memory corruption vulnerability in Adobe Flash Player and related Adobe AIR runtimes and SDKs, affecting the stated pre-patch versions on Windows, OS X, Linux and Android as listed in the advisory. An attacker can exploit it through unspecified vectors to execute arbitrary code or cause a denial of service, with no particular access, authentication, user interaction or configuration conditions identified in the available details.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:36Z"},"cvss":null,"epss":{"score":0.90135,"percentile":0.99795,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2015-06-16","exploitedFirstSeen":"2015-06-16","ransomware":true,"evidence":[{"url":"https://blog.trendmicro.com/trendlabs-security-intelligence/magnitude-exploit-kit-uses-newly-patched-adobe-vulnerability-us-canada-and-uk-are-most-at-risk/","date":"2015-06-16"},{"url":"https://securelist.com/it-threat-evolution-q2-2015/71610/","date":"2015-07-30"},{"url":"https://securelist.com/kaspersky-security-bulletin-2015-overall-statistics-for-2015/73038/","date":"2015-12-15"},{"url":"https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf","date":"2018-02-04"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":5,"pulses":[{"name":"Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows","url":"https://otx.alienvault.com/pulse/666ac558d08da6cfb3ba135b","created":"2024-06-13"},{"name":"Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'","url":"https://otx.alienvault.com/pulse/6668b85065eec626e4766a38","created":"2024-06-11"},{"name":"ReaperTest","url":"https://otx.alienvault.com/pulse/630619d510e152ced9743a56","created":"2022-08-24"},{"name":"Operation Rocket Man","url":"https://otx.alienvault.com/pulse/5b7d68bbac58cc6255d3d42c","created":"2018-08-22"},{"name":"Magnitude Exploit Kit Uses Newly Patched Adobe Vulnerability","url":"https://otx.alienvault.com/pulse/5580740bb45ff571d525e6ee","created":"2015-06-16"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-11.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/75086","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.securitytracker.com/id/1032519","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://security.gentoo.org/glsa/201506-01","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1086.html","tags":["vendor-advisory","x_refsource_REDHAT"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Flash content delivered via drive-by web pages","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Adobe Flash Player before 13.0.0.292 and 14.x through 18.x","start":0,"end":58}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Flash exploitation executes code in client application","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allow attackers to execute arbitrary code","start":375,"end":416}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Memory corruption can crash the Flash process","mappingType":"primary_impact","evidence":[{"from":"description","quote":"cause a denial of service (memory corruption)","start":420,"end":465}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-ff264eaf7a9f69a48903","title":"The Overlooked North Korean Actor","publisher":"services.google.com","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf","date":null,"mentions":[{"quote":"APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN\r\n2018 2017 2016 2015 2014\r\nCVE-2013-4979\r\nCVE-2013-4979\r\nCVE-2015-5122\r\nCVE-2016-4117\r\nCVE-2014-8439\r\nCVE-2016-1019\r\nCVE-2015-5119\r\nCVE-2015-2419\r\nCVE-2015-3105","start":8886,"end":9206}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":"Player APSB15-04 Angler\r\nCVE-2015-0336 Adobe Flash Player APSB15-05 Nuclear (JS/Neclu); Angler\r\nCVE-2015-0359 Adobe Flash Player APSB15-06 Angler\r\nCVE-2015-3090 Adobe Flash Player APSB15-09 Angler\r\nCVE-2015-3104 Adobe Flash Player APSB15-11 Angler\r\nCVE-2015-3105 Adobe Flash Player APSB15-11 Magnitude","start":81793,"end":82094},{"quote":"46, 47, 53\r\nCVE-2015-0313, 46, 47, 53\r\nCVE-2015-0336, 47, 53\r\nCVE-2015-0359, 47, 53\r\nCVE-2015-1641, 16, 57\r\nCVE-2015-1701, 14, 18, 19, 57\r\nCVE-2015-1769, 57\r\nCVE-2015-1770, 57\r\nCVE-2015-2360, 57\r\nCVE-2015-2424, 16, 17\r\nCVE-2015-3043, 17, 18, 57\r\nCVE-2015-3090, 47\r\nCVE-2015-3104, 47\r\nCVE-2015-3105,","start":238431,"end":238729}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2015-3186","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-3186","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":37448,"url":"https://www.exploit-db.com/exploits/37448","title":"Adobe Flash Player - Drawing Fill Shader Memory Corruption (Metasploit)","type":"remote","platform":"multiple","date":"2015-06-30","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2015-06-30"},"metasploit":[{"name":"Adobe Flash Player Drawing Fill Shader Memory Corruption","module":"exploit/multi/browser/adobe_flash_shader_drawing_fill","type":"exploit","disclosureDate":"2015-05-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_shader_drawing_fill.rb"}],"first":{"date":"2015-05-12","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_shader_drawing_fill.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1203","T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2015-05-12","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2015-06-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_shader_drawing_fill.rb","provenance":"source"},{"date":"2015-06-10","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2015-3105","provenance":"source"},{"date":"2015-06-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/magnitude-exploit-kit-uses-newly-patched-adobe-vulnerability-us-canada-and-uk-are-most-at-risk/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":77.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4153 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}