CVE-2015-7648
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11...
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7647.
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7647.
- Record
CVE-2015-7648- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7647.
- Record
CVE-2015-7648- Updated
- 2026-11-02
EUVDEUVD-2015-7551 No score
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7647.
- Record
EUVD-2015-7551- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xj2j-8x6x-4m9r No score
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11...
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7647.
- Record
GHSA-xj2j-8x6x-4m9r- Updated
- 2026-11-02
OSVMGASA-2015-0404 No score
Updated flash-player-plugin package fix security vulnerabilities
Adobe Flash Player 11.2.202.540 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.
This update resolves type confusion vulnerabilities that could lead to code execution (CVE-2015-7645, CVE-2015-7647, CVE-2015-7648).
An exploit for CVE-2015-7645 is being used in the wild.
- Record
MGASA-2015-0404- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-7648 No score
Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-7647.
- Record
UBUNTU-CVE-2015-7648- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 From an advisory covering 3 CVEs |
before 11.2.202.540-1.mga5.nonfree | 11.2.202.540-1.mga5.nonfree |
flash-pluginRed Hat:rhel_extras:6 From an advisory covering 3 CVEs |
before 0:11.2.202.540-1.el6_7 | 0:11.2.202.540-1.el6_7 |
flash-pluginRed Hat:rhel_extras:5::client From an advisory covering 41 CVEs |
before 0:11.2.202.548-1.el5 | 0:11.2.202.548-1.el5 |
flash-pluginRed Hat:rhel_extras:5::server From an advisory covering 41 CVEs |
before 0:11.2.202.548-1.el5 | 0:11.2.202.548-1.el5 |
flashplugin-nonfreeUbuntu:14.04:LTS |
before 11.2.202.540ubuntu0.14.04.2, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 29 moreShow less11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.1 |
11.2.202.540ubuntu0.14.04.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter | 2015-12-14 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-7648 is a high vulnerability (CVSS 10.0) in Adobe Flash Player, published October 17, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 29.5%, the 98th percentile. Fixed in flashplugin-nonfree 11.2.202.540ubuntu0.14.04.2.
References
rhn.redhat.com/errata/RHSA-2015-1913.html
securitytracker.com/id/1033850
helpx.adobe.com/security/products/flash-player/apsb15-27.html
security.gentoo.org/glsa/201511-02
exploit-db.com/exploits/38970
Show 141 moreShow less
securityfocus.com/bid/77116
nvd.nist.gov/vuln/detail/CVE-2015-7648
github.com/advisories/GHSA-xj2j-8x6x-4m9r
advisories.mageia.org/MGASA-2015-0404.html
bugs.mageia.org/show_bug.cgi?id=16970
access.redhat.com/errata/RHSA-2015:1913
bugzilla.redhat.com/show_bug.cgi?id=1271966
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1913.json
cve.org/CVERecord?id=CVE-2015-7645
cisa.gov/known-exploited-vulnerabilities-catalog
ubuntu.com/security/CVE-2015-7648