Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2015-5122 Details

Description

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA: CISA-ADPCVSS-B:7.8 HIGHVector:CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/cisagov/vulnrichment/issues/196 CISA-ADPIssue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5122 CISA-ADPUS Government Resource
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html CVEMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html CVEMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html CVEMailing ListThird Party Advisory

see all 42 references

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability NameDate AddedDue DateRequired Action
Adobe Flash Player Use-After-Free VulnerabilityApr 13, 2022May 4, 2022The impacted product is end-of-life and should be disconnected if still in use.

Weakness Enumeration

CWE-IDCWE NameSource
CWE-416Use After Free[email protected]
CWE-416Use After FreeCISA-ADP

Affected Products

ProductVersions

Change History

31 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2015-5122
NVD Published Date:
Jul 14, 2015
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2015-5122 Details - Not Deferred