CVE-2015-3105 Public exploit EPSS 90.1%

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before…

Summary

The flaw is a memory corruption vulnerability in Adobe Flash Player and related Adobe AIR runtimes and SDKs, affecting the stated pre-patch versions on Windows, OS X, Linux and Android as listed in the advisory. An attacker can exploit it through unspecified vectors to execute arbitrary code or cause a denial of service, with no particular access, authentication, user interaction or configuration conditions identified in the available details.

Official description · CVE.org

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Breakdown

77.9 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 2
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Infect visitors through a malicious websiteT1189 · Drive-by CompromiseAI-written (claude-haiku-5-5)Medium confidence3 general detection rules
What they do
- Run code when a user opens a file or pageT1203 · Exploitation for Client ExecutionAI-written (claude-haiku-5-5)Medium confidence35 general detection rules
- Crash the applicationT1499.004 · Application or System ExploitationAI-written (claude-haiku-5-5)Medium confidence3 general detection rules

First seen exploited 6 days after disclosure. Public exploit code (Metasploit) was available 29 days before disclosure.

Public exploit codeMetasploit12 May 201529 days before
Disclosed10 Jun 2015day 0
First seen exploitedVulnCheck KEV evidence16 Jun 2015+6 days

techniques

3 , grouped by in kill-chain order, 3 cited passages 3

Initial AccessTA0001

Drive-by Compromise T1189 Medium

AI mapping from the description · how it is exploited

Flash content delivered via drive-by web pages

Adobe Flash Player before 13.0.0.292 and 14.x through 18.x

From the official description (CVE.org) Original ↗

ExecutionTA0002

Exploitation for Client Execution T1203 Medium

AI mapping from the description · primary impact

Flash exploitation executes code in client application

allow attackers to execute arbitrary code

From the official description (CVE.org) Original ↗

ImpactTA0040

Application or System Exploitation T1499.004 Medium

AI mapping from the description · primary impact

Memory corruption can crash the Flash process

cause a denial of service (memory corruption)

From the official description (CVE.org) Original ↗

Detection

0 rules for this CVE · 41 general rules for its techniques

Rules for this CVE

0 that reference CVE-2015-3105 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules

Cross Site Scripting Stringshightest
Flash Player Update from Suspicious Locationhightest
Suspicious Browser Child Process - MacOSmediumtest

Exploitation for Client ExecutionT120335 general rules

Antivirus - Exploitation Framework Signaturecriticalstable
Droppers Exploiting CVE-2017-11882criticalstable
Audit CVE Eventcriticaltest
CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
Exploit for CVE-2017-8759criticaltest
Antivirus - APT Malware Signaturecriticalexperimental
Antivirus - Remote Access Tools Signaturecriticalexperimental

All 35 on SigmaHQ ↗

Application or System ExploitationT1499.0043 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 2 threat reports

2 reportsMicrosoftservices.google.com

Reports are matched by finding the exact id CVE-2015-3105 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

MicrosoftUndated

Microsoft Security

Player APSB15-04 Angler CVE-2015-0336 Adobe Flash Player APSB15-05 Nuclear (JS/Neclu); Angler CVE-2015-0359 Adobe Flash Player APSB15-06 Angler CVE-2015-3090 Adobe Flash Player APSB15-09 Angler CVE-2015-3104 Adobe Flash Player APSB15-11 Angler CVE-2015-3105 Adobe Flash Player APSB15-11 Magnitude…

2 passages name itOriginal (opens in a new tab) ↗

services.google.comUndated

The Overlooked North Korean Actor

Mentions the CVE; no further detail.

Original (opens in a new tab) ↗

Also mentioned in 5 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows13 Jun 2024
Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'11 Jun 2024
ReaperTest24 Aug 2022
Operation Rocket Man22 Aug 2018
Magnitude Exploit Kit Uses Newly Patched Adobe Vulnerability16 Jun 2015

References

8 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2015-3186

Adobe Flash Player - Drawing Fill Shader Memory Corruption (Metasploit)EDB-37448 · remote · multiple · 2015-06-30 · verified

, 30 Oct 2026

90.1%Top 0.2%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.8%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 4155 days ago 0.0/10

Known ransomware useVulnCheck KEV: Known 10.0/10

EPSS percentilepercentile 0.9980 20.0/20

Threat reports2 reports 6.1/10

Public exploit code1 Exploit-DB entry; 1 Metasploit module 5.0/5

Mentioned in OTX pulses5 pulses 1.8/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total77.9

Record

Published: 10 Jun 2015
Modified: 6 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Microsoft Security

The Overlooked North Korean Actor

Also mentioned in 5 community threat pulses (AlienVault OTX)

References

x_refsource_CONFIRM 1

vdb-entry 2

vendor-advisory 5

How attackers get in

What they do

techniques