Adobe · Flash Player
End of lifeAdobe Flash Player reached End of lifeThe vendor no longer ships security fixes. Remove or isolate the product instead of waiting for a patch. on 31 Dec 2020. No patch is coming: remove or isolate it.
Adobe Flash Player has a use-after-free flaw in the ByteArray class of its ActionScript 3 implementation, affecting the 13.x through 13.0.0.296, 14.x through 18.0.0.194 and 11.x through 11.2.202.468 releases on Windows, OS X and Linux. A remote, unauthenticated attacker can exploit it without user interaction by supplying crafted Flash content that overrides a valueOf function, enabling arbitrary code execution or a denial of service through memory corruption.
Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
First seen exploited 3 days before it was disclosed. Public exploit code (Metasploit) was available 2 days before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
To exploit this vulnerability, adversaries sent spearphishing emails with URLs to webpages with maliciously crafted javascript. The adversaries then download a payload.
This vulnerability has been exploited in the wild by multiple different threat actors. Threat groups send phishing emails with URLs where maliciously-crafted javascript is hosted. This CVE has many mappable exploitation techniques and impacts. These adversaries using this exploit to deliver malicious payloads to the target machines establish DLL backdoors.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2015-5119 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
PLEAD also dabbled with a short-lived, fileless version of their malware when it obtained an exploit for a Flash vulnerability (CVE-2015-5119) that was leaked during the Hacking Team breach.
2 passages name itOriginal (opens in a new tab) ↗
C NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN DEC NOV OCT SEP AUG JUL JUN MAY APR MAR FEB JAN 2018 2017 2016 2015 2014 CVE-2013-4979 CVE-2013-4979 CVE-2015-5122 CVE-2016-4117 CVE-2014-8439 CVE-2016-1019 CVE-2015-5119…
An exploit that targets a vulnerability in Adobe Flash Player (CVE- 2015-5119) to download and run files, including malware like…
3 passages name itOriginal (opens in a new tab) ↗
Mentions the CVE; no further detail.
Mentions the CVE; no further detail.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.