CVEvulnerability

CVE-2015-0310

7.8 HIGH Known exploited Published 2015-01-23 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Adobe Flash Player ASLR Bypass Vulnerability — Adobe Flash Player

Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.

Added to KEV: 2022-05-25
Remediation due: 2022-06-15
Ransomware use: Unknown
Required action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2015-0310

Status: Analyzed
Published: 2015-01-23
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses: CWE-200

Description

Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.

Affected configurations

• adobe flash player (< 11.2.202.438) • adobe flash player (< 13.0.0.262) • adobe flash player (>= 14.0 < 16.0.0.287)

Weakness · CWE (1)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References