{"id":"CVE-2015-7648","aliases":["EUVD-2015-7551","GHSA-xj2j-8x6x-4m9r","MGASA-2015-0404","RHSA-2015:1913","RHSA-2015:2024","UBUNTU-CVE-2015-7648"],"status":"published","title":"Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11...","description":"Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2015-7647.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.29525,"percentile":0.98201,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2015-10-17T08:53:25Z","modified":"2026-06-29T10:10:29Z","exploits":[{"source":"exploitdb","id":"EDB-38970","title":"Adobe Flash - Type Confusion in Serialization with ObjectEncoder.dynamicPropertyWriter","type":"dos","platform":"multiple","date":"2015-12-14","verified":true,"url":"https://www.exploit-db.com/exploits/38970"}],"fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["11.2.202.540ubuntu0.14.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.540-1.mga5.nonfree"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.540-1.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.548-1.el5"}]}],"bundled":41},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.548-1.el5"}]}],"bundled":41},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.540ubuntu0.14.04.2"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.2","11.2.202.491ubuntu0.14.04.1","11.2.202.508ubuntu0.14.04.1","11.2.202.521ubuntu0.14.04.1","11.2.202.535ubuntu0.14.04.1"]}],"products":[{"vendor":"adobe","product":"flash_player"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2015-1913.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-2024.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://www.securitytracker.com/id/1033850","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-27.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","article"]},{"url":"https://security.gentoo.org/glsa/201511-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://www.exploit-db.com/exploits/38970/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/77116","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7648","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/38970"},{"url":"https://github.com/advisories/GHSA-xj2j-8x6x-4m9r"},{"url":"https://advisories.mageia.org/MGASA-2015-0404.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16970","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1913","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271966","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1913.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7645","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7645","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7645","tags":["advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa15-05.html","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7647","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7647","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7648","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7648","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2024","tags":["advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-25.html","tags":["article"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb15-28.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1271388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1280062","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2024.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-5569","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5569","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7625","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7625","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7625","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7626","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7626","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7626","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7627","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7627","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7628","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7628","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7628","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7629","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7629","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7629","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7630","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7630","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7630","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7631","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7631","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7632","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7632","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7633","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7633","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7633","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7634","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7634","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7634","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7635","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7635","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7636","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7636","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7636","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7637","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7638","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7638","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7639","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7639","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7639","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7640","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7640","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7640","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7641","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7641","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7641","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7642","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7642","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7643","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7643","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7644","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7644","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7651","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7651","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7652","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7652","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7652","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7653","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7653","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7654","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7654","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7654","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7655","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7655","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7655","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7656","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7656","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7656","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7657","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7657","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7657","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7658","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7659","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7659","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7660","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7661","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7661","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7661","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7662","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7663","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7663","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7663","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8042","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8042","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8042","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8043","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8043","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8043","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8044","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8044","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8044","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-8046","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8046","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8046","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-7648","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-7648","description":"Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2015-7647.","status":"published","published":"2015-10-18T10:00:00Z","modified":"2024-08-06T07:58:58.368Z","updated_at":"2026-11-02T14:35:45.088047Z"}],"euvd":[{"id":"EUVD-2015-7551","description":"Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2015-7647.","status":"published","published":"2015-10-18T10:00:00Z","modified":"2024-08-06T07:58:58Z","updated_at":"2026-11-03T02:21:52.097705Z"}],"ghsa":[{"id":"GHSA-xj2j-8x6x-4m9r","title":"Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11...","description":"Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2015-7647.","status":"published","published":"2022-05-17T01:07:24Z","modified":"2025-04-12T12:54:03Z","updated_at":"2026-11-02T15:01:24.215593Z"}],"nvd":[{"id":"CVE-2015-7648","description":"Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2015-7647.","status":"published","published":"2015-10-18T10:59:14.35Z","modified":"2026-06-17T00:32:53.76Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:10.919251Z"}],"osv":[{"id":"MGASA-2015-0404","title":"Updated flash-player-plugin package fix security vulnerabilities","description":"Adobe Flash Player 11.2.202.540 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow\nan attacker to take control of the affected system.\n\nThis update resolves type confusion vulnerabilities that could lead to\ncode execution (CVE-2015-7645, CVE-2015-7647, CVE-2015-7648).\n\nAn exploit for CVE-2015-7645 is being used in the wild.\n","status":"published","published":"2015-10-17T08:53:25Z","modified":"2026-04-16T06:25:11.829259021Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2015:1913","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T09:46:23Z","modified":"2026-06-29T10:10:20Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:2024","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T09:46:35Z","modified":"2026-06-29T10:10:29Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"UBUNTU-CVE-2015-7648","description":"Adobe Flash Player before 18.0.0.255 and 19.x before 19.0.0.226 on Windows and OS X and before 11.2.202.540 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \"type confusion,\" a different vulnerability than CVE-2015-7647.","status":"published","published":"2015-10-18T10:59:00Z","modified":"2025-07-16T07:33:24.673557Z","updated_at":"2026-11-02T15:54:10.737723Z"}]}}