Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-3101

The Flash broker in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, when Internet Explorer is used, allows attackers to perform a transition from Low Integrity to Medium Integrity via unspecified vectors.

Security Impact Summary

CVE-2015-3101 is a security vulnerability that . Impacting 8 products from adobe, from google, from adobe and 5 others, organizations running these solutions should prioritize assessment and patching.

Historical Context

First disclosed in 2015, this vulnerability was reported during a period defined by widespread IoT adoption challenges, mobile security concerns, and the emergence of advanced persistent threat (APT) techniques. Contemporary mitigation strategies focused on secure development practices and third-party component vetting.

Published

2015-06-10T01:59:43.987

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application adobe air ≤ 17.0.0.144 Yes
Operating System google android * Yes
Application adobe flash_player ≤ 13.0.0.289 Yes
Application adobe flash_player 14.0.0.125 Yes
Application adobe flash_player 14.0.0.145 Yes
Application adobe flash_player 14.0.0.176 Yes
Application adobe flash_player 14.0.0.179 Yes
Application adobe flash_player 15.0.0.152 Yes
Application adobe flash_player 15.0.0.167 Yes
Application adobe flash_player 15.0.0.189 Yes
Application adobe flash_player 15.0.0.223 Yes
Application adobe flash_player 15.0.0.239 Yes
Application adobe flash_player 15.0.0.246 Yes
Application adobe flash_player 16.0.0.235 Yes
Application adobe flash_player 16.0.0.257 Yes
Application adobe flash_player 16.0.0.287 Yes
Application adobe flash_player 16.0.0.296 Yes
Application adobe flash_player 17.0.0.134 Yes
Application adobe flash_player 17.0.0.169 Yes
Application adobe flash_player 17.0.0.188 Yes
Operating System apple mac_os_x - No
Operating System microsoft windows - No
Application adobe air ≤ 17.0.0.172 Yes
Application adobe air_sdk ≤ 17.0.0.172 Yes
Application adobe air_sdk_\&_compiler ≤ 17.0.0.172 Yes
Operating System apple mac_os_x - No
Operating System microsoft windows - No
Application adobe flash_player ≤ 11.2.202.460 Yes
Operating System linux linux_kernel - No
References

How SecUtils Interprets This CVE

SecUtils normalizes and enriches National Vulnerability Database (NVD) records by standardizing vendor and product identifiers, aggregating vulnerability metadata from both NVD and MITRE sources, and providing structured context for security teams. For adobe's affected products, we extract Common Platform Enumeration (CPE) data, Common Weakness Enumeration (CWE) classifications, CVSS severity metrics, and reference data to enable rapid vulnerability prioritization and asset correlation. This record contains no exploit code, proof-of-concept instructions, or attack methodologies—only defensive intelligence necessary for patch management, risk assessment, and security operations.