{"id":"CVE-2015-3101","aliases":["EUVD-2015-3182","GHSA-m86v-3qv8-q72m","MGASA-2015-0248","UBUNTU-CVE-2015-3101"],"status":"published","title":"The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160...","description":"The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK \u0026 Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01304,"percentile":0.70698,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2015-06-10T01:00:00Z","modified":"2026-06-17T00:25:17Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["11.2.202.466ubuntu0.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:4","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.468-1.mga4.nonfree"}]}],"bundled":13},{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.468-1.mga5.nonfree"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.466ubuntu0.14.04.1"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1"]}],"products":[{"vendor":"adobe","product":"air"},{"vendor":"adobe","product":"air_sdk"},{"vendor":"adobe","product":"air_sdk_\\\u0026_compiler"},{"vendor":"adobe","product":"flash_player"},{"vendor":"google","product":"android"}],"references":[{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-11.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"http://www.securitytracker.com/id/1032519","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://security.gentoo.org/glsa/201506-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"http://www.securityfocus.com/bid/75089","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3101"},{"url":"https://github.com/advisories/GHSA-m86v-3qv8-q72m"},{"url":"https://advisories.mageia.org/MGASA-2015-0248.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16139","tags":["report"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-14.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3101","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3101","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3101","description":"The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK \u0026 Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors.","status":"published","published":"2015-06-10T01:00:00Z","modified":"2024-08-06T05:39:30.464Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2015-3182","description":"The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK \u0026 Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors.","status":"published","published":"2015-06-10T01:00:00Z","modified":"2024-08-06T05:39:30Z","updated_at":"2026-11-03T02:22:09.620925Z"}],"ghsa":[{"id":"GHSA-m86v-3qv8-q72m","title":"The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160...","description":"The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK \u0026 Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors.","status":"published","published":"2022-05-17T03:11:56Z","modified":"2023-01-27T05:07:39Z","updated_at":"2026-11-02T14:43:09.795502Z"}],"nvd":[{"id":"CVE-2015-3101","description":"The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK \u0026 Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors.","status":"published","published":"2015-06-10T01:59:43.987Z","modified":"2026-06-17T00:25:17.793Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"MGASA-2015-0248","title":"Updated flash-player-plugin package fixes security vulnerability","description":"Adobe Flash Player 11.2.202.468 contains fixes to critical security\nvulnerabilities found in earlier versions that could cause a crash and\npotentially allow an attacker to take control of the affected system.\n\nAdobe is aware of reports that CVE-2015-3113 is being actively exploited in\nthe wild via limited, targeted attacks. Systems running Internet Explorer\nfor Windows 7 and below, as well as Firefox on Windows XP, are known targets.\n\nThis update resolves a heap buffer overflow vulnerability that could lead to\ncode execution (CVE-2015-3113).\n\nThis update resolves a vulnerability (CVE-2015-3096) that could be exploited\nto bypass the fix for CVE-2014-5333.\n\nThis update resolves vulnerabilities that could be exploited to bypass the\nsame-origin-policy and lead to information disclosure (CVE-2015-3098,\nCVE-2015-3099, CVE-2015-3102).\n\nThis update resolves a stack overflow vulnerability that could lead to code\nexecution (CVE-2015-3100).\n\nThis update resolves a permission issue in the Flash broker for Internet\nExplorer that could be exploited to perform privilege escalation from low to\nmedium integrity level (CVE-2015-3101).    \n\nThis update resolves an integer overflow vulnerability that could lead to\ncode execution (CVE-2015-3104).\n\nThis update resolves a memory corruption vulnerability that could lead to\ncode execution (CVE-2015-3105).\n\nThis update resolves use-after-free vulnerabilities that could lead to\ncode execution (CVE-2015-3103, CVE-2015-3106, CVE-2015-3107).\n\nThis update resolves a memory leak vulnerability that could be used to\nbypass ASLR (CVE-2015-3108).\n","status":"published","published":"2015-06-24T05:58:28Z","modified":"2026-04-16T06:24:07.398045845Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-3101","description":"The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK \u0026 Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors.","status":"published","published":"2015-06-10T01:59:00Z","modified":"2025-07-16T07:32:50.883256Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}