Every CVESearch/Get API key

CVE-2015-5569

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11...

10.0 HighFix available

CVE-2015-5569 is a high vulnerability (CVSS 10.0) in Adobe Air, published October 14, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.17%, the 92nd percentile. Fixed in flashplugin-nonfree 11.2.202.535ubuntu0.14.04.1.

Severity
10.0 HighCVSS 2.0, NVD
Exploit chance
5.17%EPSS, 92nd percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
11.2.202.535ubuntu0.14.04.1flashplugin-nonfree +7 more

Description

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors.

Exploit likelihood

5.17%Up 3.6 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flash-plugin
Red Hat:rhel_extras:6
From an advisory covering 21 CVEs
before 0:11.2.202.535-1.el6_7
0:11.2.202.535-1.el6_7
flash-plugin
Red Hat:rhel_extras:5::client
From an advisory covering 41 CVEs
before 0:11.2.202.548-1.el5
0:11.2.202.548-1.el5
flash-plugin
Red Hat:rhel_extras:5::server
From an advisory covering 41 CVEs
before 0:11.2.202.548-1.el5
0:11.2.202.548-1.el5
flash-player
SUSE:Linux Enterprise Desktop 12
From an advisory covering 13 CVEs
before 11.2.202.535-105.1
11.2.202.535-105.1
flash-player
SUSE:Linux Enterprise Workstation Extension 12
From an advisory covering 13 CVEs
before 11.2.202.535-105.1
11.2.202.535-105.1
flash-player
SUSE:Linux Enterprise Desktop 11 SP3
From an advisory covering 13 CVEs
before 11.2.202.535-0.20.1
11.2.202.535-0.20.1
flash-player
SUSE:Linux Enterprise Desktop 11 SP4
From an advisory covering 13 CVEs
before 11.2.202.535-0.20.1
11.2.202.535-0.20.1
flashplugin-nonfree
Ubuntu:14.04:LTS
before 11.2.202.535ubuntu0.14.04.1, plus listed versions
11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1
Show 28 moreShow less
11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.1
11.2.202.535ubuntu0.14.04.1

What each source reports

NVD Score used10.0

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors.

Record
CVE-2015-5569
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE ListNo score

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors.

Record
CVE-2015-5569
Updated
2026-11-02
EUVDEUVD-2015-5523No score

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors.

Record
EUVD-2015-5523
Updated
2026-11-03
GitHub AdvisoriesGHSA-3cqq-q6w5-34hfNo score

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11...

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors.

Record
GHSA-3cqq-q6w5-34hf
Updated
2026-11-02
OSVSUSE-SU-2015:1740-1No score

Security update for flash-player

flash-player was updated to version 11.2.202.535 to fix 13 security issues (bsc#950169).

These security issues were fixed:

  • A vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-7628).
  • A defense-in-depth feature in the Flash broker API (CVE-2015-5569).
  • Use-after-free vulnerabilities that could lead to code execution (CVE-2015-7629, CVE-2015-7631, CVE-2015-7643, CVE-2015-7644).
  • A buffer overflow vulnerability that could lead to code execution (CVE-2015-7632).
  • Memory corruption vulnerabilities that could lead to code execution (CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).
Record
SUSE-SU-2015:1740-1
Updated
2026-11-02
OSVSUSE-SU-2015:1742-1No score

Security update for flash-player

flash-player was updated to version 11.2.202.535 to fix 13 security issues (bsc#950169).

These security issues were fixed:

  • A vulnerability that could be exploited to bypass the same-origin-policy and lead to information disclosure (CVE-2015-7628).
  • A defense-in-depth feature in the Flash broker API (CVE-2015-5569).
  • Use-after-free vulnerabilities that could lead to code execution (CVE-2015-7629, CVE-2015-7631, CVE-2015-7643, CVE-2015-7644).
  • A buffer overflow vulnerability that could lead to code execution (CVE-2015-7632).
  • Memory corruption vulnerabilities that could lead to code execution (CVE-2015-7625, CVE-2015-7626, CVE-2015-7627, CVE-2015-7630, CVE-2015-7633, CVE-2015-7634).
Record
SUSE-SU-2015:1742-1
Updated
2026-11-02
OSVUBUNTU-CVE-2015-5569No score

Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 improperly implement the Flash broker API, which has unspecified impact and attack vectors.

Record
UBUNTU-CVE-2015-5569
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 158 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open