Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-3085

Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow remote attackers to bypass intended restrictions on filesystem write operations via unspecified vectors, a different vulnerability than CVE-2015-3082 and CVE-2015-3083.

Security Impact Summary

CVE-2015-3085 is a security vulnerability that . Impacting 7 products from adobe, from adobe, from adobe and 4 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

First disclosed in 2015, this vulnerability was reported during a period defined by widespread IoT adoption challenges, mobile security concerns, and the emergence of advanced persistent threat (APT) techniques. Contemporary mitigation strategies focused on secure development practices and third-party component vetting.

Published

2015-05-13T11:00:16.830

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.4 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application adobe air ≤ 17.0.0.144 Yes
Application adobe air_sdk ≤ 17.0.0.144 Yes
Application adobe air_sdk_\&_compiler ≤ 17.0.0.144 Yes
Application adobe flash_player ≤ 13.0.0.264 Yes
Application adobe flash_player 14.0.0.125 Yes
Application adobe flash_player 14.0.0.145 Yes
Application adobe flash_player 14.0.0.176 Yes
Application adobe flash_player 14.0.0.179 Yes
Application adobe flash_player 15.0.0.152 Yes
Application adobe flash_player 15.0.0.167 Yes
Application adobe flash_player 15.0.0.189 Yes
Application adobe flash_player 15.0.0.223 Yes
Application adobe flash_player 15.0.0.239 Yes
Application adobe flash_player 15.0.0.246 Yes
Application adobe flash_player 16.0.0.235 Yes
Application adobe flash_player 16.0.0.257 Yes
Application adobe flash_player 16.0.0.287 Yes
Application adobe flash_player 16.0.0.296 Yes
Application adobe flash_player 17.0.0.134 Yes
Application adobe flash_player 17.0.0.169 Yes
Operating System apple mac_os_x - No
Operating System microsoft windows - No
Application adobe flash_player ≤ 11.2.202.475 Yes
Operating System linux linux_kernel - No
References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For adobe's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.