CVE-2015-0312

Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16...

9.3 HighFix available

Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16.0.0.296 on Windows and OS X and before 11.2.202.440 on Linux allows attackers to execute arbitrary code via unspecified vectors.

Exploit likelihood

7.08%Up 2.9 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2015-0312
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-415
Updated: 2026-11-02

CVE List No score

Record: CVE-2015-0312
Updated: 2026-11-02

EUVDEUVD-2015-0325 No score

Record: EUVD-2015-0325
Updated: 2026-11-03

GitHub AdvisoriesGHSA-3fv2-9g2f-63h7 No score

Double free vulnerability in Adobe Flash Player before 13.0.0.264 and 14.x through 16.x before 16...

Record: GHSA-3fv2-9g2f-63h7
Weakness: CWE-415
Updated: 2026-11-02

OSVMGASA-2015-0043 No score

Updated flash-player-plugin packages fix security vulnerabilities

Adobe Flash Player 11.2.202.440 contains fixes to critical security vulnerabilities found in earlier versions that could cause a crash and potentially allow an attacker to take control of the affected system.

Adobe reports that CVE-2015-0311 is already being actively exploited in the wild via drive-by-download attacks against systems running Internet Explorer and Firefox on Windows.

This update resolves a use-after-free vulnerability that could lead to code execution (CVE-2015-0311).

This update resolves a double-free vulnerability that could lead to code execution (CVE-2015-0312).

Record: MGASA-2015-0043
Updated: 2026-11-02

OSVUBUNTU-CVE-2015-0312 No score

Record: UBUNTU-CVE-2015-0312
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`flash-player-plugin` Mageia:4 From an advisory covering 2 CVEs	before 11.2.202.440-1.1.mga4.nonfree	11.2.202.440-1.1.mga4.nonfree
`flash-plugin` Red Hat:rhel_extras:5::client From an advisory covering 3 CVEs	before 0:11.2.202.440-1.el5	0:11.2.202.440-1.el5
`flash-plugin` Red Hat:rhel_extras:5::server From an advisory covering 3 CVEs	before 0:11.2.202.440-1.el5	0:11.2.202.440-1.el5
`flash-plugin` Red Hat:rhel_extras:6 From an advisory covering 3 CVEs	before 0:11.2.202.440-1.el6	0:11.2.202.440-1.el6
`flashplugin-nonfree` Ubuntu:14.04:LTS	before 11.2.202.440ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 16 moreShow less 11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.1	11.2.202.440ubuntu0.14.04.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-0312 is a high vulnerability (CVSS 9.3) in Adobe Flash Player, published January 27, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.08%, the 94th percentile. Fixed in flashplugin-nonfree 11.2.202.440ubuntu0.14.04.1.

References

Show 24 moreShow less