{"id":"CVE-2015-5122","aliases":["EUVD-2015-5137","GHSA-9h3m-vp3m-35pw","MGASA-2015-0275","RHSA-2015:1235","SUSE-SU-2015:1255-1","SUSE-SU-2015:1258-1","UBUNTU-CVE-2015-5122"],"status":"published","title":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)...","description":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.87033,"percentile":0.9975,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-416"],"published":"2015-07-14T10:00:00Z","modified":"2026-06-29T10:09:36Z","kev":{"date_added":"2022-04-13","due_date":"2022-05-04","required_action":"The impacted product is end-of-life and should be disconnected if still in use.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-04-13"},{"source":"kev","since":"2022-04-13"}],"exploits":[{"source":"metasploit","id":"exploit/multi/browser/adobe_flash_opaque_background_uaf","title":"Adobe Flash opaqueBackground Use After Free","type":"exploit","platform":"Windows","date":"2015-07-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_opaque_background_uaf"},{"source":"exploitdb","id":"EDB-37599","title":"Adobe Flash - opaqueBackground Use-After-Free (Metasploit)","type":"remote","platform":"windows","date":"2015-07-13","verified":true,"url":"https://www.exploit-db.com/exploits/37599"}],"fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["11.2.202.481ubuntu0.14.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:4","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.491-1.mga4.nonfree"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.491-1.mga5.nonfree"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.491-1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.491-1.el5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.491-1.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.491-96.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.491-96.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.491-0.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.491-0.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.481ubuntu0.14.04.2"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1"]}],"products":[{"vendor":"adobe","product":"flash player"},{"vendor":"adobe","product":"flash_player"},{"vendor":"adobe","product":"flash_player_desktop_runtime"},{"vendor":"opensuse","product":"evergreen"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"suse","product":"linux_enterprise_desktop"},{"vendor":"suse","product":"linux_enterprise_workstation_extension"}],"references":[{"url":"http://www.securitytracker.com/id/1032890","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"http://marc.info/?l=bugtraq\u0026m=144050155601375\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://www.fireeye.com/blog/threat-research/2015/07/cve-2015-5122_-_seco.html","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory","report"]},{"url":"http://www.us-cert.gov/ncas/alerts/TA15-195A","tags":["third-party-advisory","x_refsource_CERT","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-18.html","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Vendor Advisory","web","article"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201508-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"http://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_opaque_background_uaf","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784","tags":["vendor-advisory","x_refsource_HP","x_transferred","Broken Link","Third Party Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1235.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/338736","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","report"]},{"url":"https://www.exploit-db.com/exploits/37599/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/75712","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/132663/Adobe-Flash-opaqueBackground-Use-After-Free.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://perception-point.io/2018/04/11/breaking-cfi-cve-2015-5122-coop/","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa15-04.html","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Vendor Advisory","article","report"]},{"url":"https://perception-point.io/new/breaking-cfi.php","tags":["x_refsource_MISC","x_transferred","Broken Link","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5122","tags":["government-resource","US Government Resource"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","tags":["issue-tracking","Issue Tracking"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5122","tags":["advisory"]},{"url":"https://perception-point.io/2018/04/11/breaking-cfi-cve-2015-5122-coop"},{"url":"https://www.exploit-db.com/exploits/37599"},{"url":"https://github.com/advisories/GHSA-9h3m-vp3m-35pw"},{"url":"https://advisories.mageia.org/MGASA-2015-0275.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16392","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1235","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1242216","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1235.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5122","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5122","tags":["advisory","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5123","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5123","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5123","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151255-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/937752","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5123","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151258-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5122","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-5122","description":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.","status":"published","published":"2015-07-14T10:00:00Z","modified":"2025-11-17T22:01:00.592Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:35:40.217028Z"}],"euvd":[{"id":"EUVD-2015-5137","description":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.","status":"published","published":"2015-07-14T10:00:00Z","modified":"2025-11-17T22:01:00Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-04-13","updated_at":"2026-11-02T19:49:15.806163Z"}],"ghsa":[{"id":"GHSA-9h3m-vp3m-35pw","title":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)...","description":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.","status":"published","published":"2022-05-13T01:06:52Z","modified":"2025-11-18T00:30:17Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:04:50.769565Z"}],"kev":[{"id":"CVE-2015-5122","title":"Adobe Flash Player Use-After-Free Vulnerability","description":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).","cwes":["CWE-416"],"kev":{"date_added":"2022-04-13","due_date":"2022-05-04","required_action":"The impacted product is end-of-life and should be disconnected if still in use.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2015-5122","description":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.","status":"published","published":"2015-07-14T10:59:00.213Z","modified":"2026-06-17T00:28:30.877Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"UBUNTU-CVE-2015-5122","description":"Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.","status":"published","published":"2015-07-14T10:59:00Z","modified":"2025-11-19T16:48:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"MGASA-2015-0275","title":"Updated flash-player-plugin package fixes security vulnerabilities","description":"Adobe Flash Player 11.2.202.491 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow\nan attacker to take control of the affected system.\n\nAdobe is aware of reports that exploits targeting these vulnerabilities\nhave been published publicly.\n\nThis update resolves a use-after-free vulnerability that could lead to\ncode execution (CVE-2015-5122).\n\nThis update resolves a memory corruption vulnerability that could lead\nto code execution (CVE-2015-5123).\n","status":"published","published":"2015-07-16T21:20:30Z","modified":"2026-04-16T06:23:34.295787659Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2015:1235","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T10:37:04Z","modified":"2026-06-29T10:09:36Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:1255-1","title":"Security update for flash-player","description":"flash-player was updated to fix two security issues.\n\nThese security issues were fixed:\n- CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752).\n- CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752).\n  ","status":"published","published":"2015-07-16T15:52:35Z","modified":"2026-02-04T03:24:34.760578Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1258-1","title":"Security update for flash-player","description":"flash-player was updated to fix two security issues.\n\nThese security issues were fixed:\n- CVE-2015-5123: Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function (bsc#937752).\n- CVE-2015-5122: Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property (bsc#937752).\n  ","status":"published","published":"2015-07-16T15:52:33Z","modified":"2026-02-04T04:10:32.787659Z","updated_at":"2026-11-02T15:53:43.030986Z"}]}}