Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-0310

Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.

Published

2015-01-23T21:59:00.050

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Primary
    NVD-CWE-noinfo
  • Type: Secondary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application adobe flash_player < 11.2.202.438 Yes
Operating System linux linux_kernel - No
Application adobe flash_player < 13.0.0.262 Yes
Application adobe flash_player < 16.0.0.287 Yes
Operating System apple mac_os_x - No
Operating System microsoft windows - No
References