CVE-2015-8459
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and...
CVE-2015-8459 is a critical vulnerability (CVSS 10.0) in Adobe Air, published December 28, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.12%, the 93rd percentile. Fixed in flash-player-plugin 11.2.202.559-1.mga5.nonfree.
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8460, CVE-2015-8636, and CVE-2015-8645.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8460, CVE-2015-8636, and CVE-2015-8645.
- Record
CVE-2015-8459- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8460, CVE-2015-8636, and CVE-2015-8645.
- Record
CVE-2015-8459- Updated
- 2026-11-02
EUVDEUVD-2015-8341 No score
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8460, CVE-2015-8636, and CVE-2015-8645.
- Record
EUVD-2015-8341- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mfxr-fj8r-f93p
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and...
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8460, CVE-2015-8636, and CVE-2015-8645.
- Record
GHSA-mfxr-fj8r-f93p- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-8459
Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8460, CVE-2015-8636, and CVE-2015-8645.
- Record
UBUNTU-CVE-2015-8459- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2015-0493 No score
Updated flash-player-plugin packages fix security vulnerabilities
Adobe Flash Player 11.2.202.559 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.
This update resolves a type confusion vulnerability that could lead to code execution (CVE-2015-8644).
This update resolves an integer overflow vulnerability that could lead to code execution (CVE-2015-8651).
This update resolves use-after-free vulnerabilities that could lead to code execution (CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650).
This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2015-8459, CVE-2015-8460, CVE-2015-8636, CVE-2015-8645).
- Record
MGASA-2015-0493- Updated
- 2026-11-02
OSVSUSE-SU-2015:2401-1 No score
Security update for flash-player
This update for flash-player fixes the following issues:
- CVE-2015-8644: Type confusion vulnerability that could lead to code execution .
- CVE-2015-8651: Integer overflow vulnerability that could lead to code execution.
- CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650: Use-after-free vulnerabilities that could lead to code execution.
- CVE-2015-8459, CVE-2015-8460, CVE-2015-8636, CVE-2015-8645: Memory corruption vulnerabilities that could lead to code execution.
- Record
SUSE-SU-2015:2401-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:2402-1 No score
Security update for flash-player
This update for flash-player fixes the following issues:
- CVE-2015-8644: Type confusion vulnerability that could lead to code execution.
- CVE-2015-8651: Integer overflow vulnerability that could lead to code execution.
- CVE-2015-8634, CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, CVE-2015-8650: Use-after-free vulnerabilities that could lead to code execution.
- CVE-2015-8459, CVE-2015-8460, CVE-2015-8636, CVE-2015-8645: Memory corruption vulnerabilities that could lead to code execution.
- Record
SUSE-SU-2015:2402-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 |
before 11.2.202.559-1.mga5.nonfree | 11.2.202.559-1.mga5.nonfree |
flash-pluginRed Hat:rhel_extras:5::client |
before 0:11.2.202.559-1.el5 | 0:11.2.202.559-1.el5 |
flash-pluginRed Hat:rhel_extras:5::server |
before 0:11.2.202.559-1.el5 | 0:11.2.202.559-1.el5 |
flash-pluginRed Hat:rhel_extras:6 |
before 0:11.2.202.559-1.el6_7 | 0:11.2.202.559-1.el6_7 |
flash-playerSUSE:Linux Enterprise Desktop 12 |
before 11.2.202.559-117.1 | 11.2.202.559-117.1 |
flash-playerSUSE:Linux Enterprise Desktop 12 SP1 |
before 11.2.202.559-117.1 | 11.2.202.559-117.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 |
before 11.2.202.559-117.1 | 11.2.202.559-117.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 SP1 |
before 11.2.202.559-117.1 | 11.2.202.559-117.1 |
flash-playerSUSE:Linux Enterprise Desktop 11 SP3 |
before 11.2.202.559-0.32.1 | 11.2.202.559-0.32.1 |
flash-playerSUSE:Linux Enterprise Desktop 11 SP4 |
before 11.2.202.559-0.32.1 | 11.2.202.559-0.32.1 |
flashplugin-nonfreeUbuntu:14.04:LTS |
before 11.2.202.559ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 32 moreShow less11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.1 |
11.2.202.559ubuntu0.14.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.opensuse.org/opensuse-security-announce/2015-12/msg00048.html
securitytracker.com/id/1034544
rhn.redhat.com/errata/RHSA-2015-2697.html
h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05385680
helpx.adobe.com/security/products/flash-player/apsb16-01.html
Show 97 moreShow less
securityfocus.com/bid/79700
security.gentoo.org/glsa/201601-03
nvd.nist.gov/vuln/detail/CVE-2015-8459
github.com/advisories/GHSA-mfxr-fj8r-f93p
advisories.mageia.org/MGASA-2015-0493.html
bugs.mageia.org/show_bug.cgi?id=17411
access.redhat.com/errata/RHSA-2015:2697
bugzilla.redhat.com/show_bug.cgi?id=1294580
security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2697.json
cve.org/CVERecord?id=CVE-2015-8459
cisa.gov/known-exploited-vulnerabilities-catalog
suse.com/support/update/announcement/2015/suse-su-20152401-1
bugzilla.suse.com/960317
ubuntu.com/security/CVE-2015-8459