cbcvebase.
CVE-2015-3080
published 2015-05-13

CVE-2015-3080: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on…

PriorityP272critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
56.55%
99.0th percentile
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allows attackers to execute arbitrary code via unspecified vectors.

Affected

21 ranges
VendorProductVersion rangeFixed in
adobeair<= 17.0.0.144
adobeair_sdk<= 17.0.0.144
adobeair_sdk_compiler<= 17.0.0.144
adobeflash_player<= 13.0.0.264
adobeflash_player<= 11.2.202.475
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player
adobeflash_player

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37853.zip
filenamemapBitmap_as2.swf
bytes
52 17 96 02 00 04 03 26 -> 17 17 17 17 17 17 17 17
  • Look for SWF files exploiting DisplacementMapFilter.mapBitmap property via AS2 with a custom/overridden BitmapData constructor — the exploit overrides flash.display.BitmapData with a custom class (MyBitmapData) to trigger the use-after-free.
  • Detect SWF files containing AS2 bytecode where the BitmapData constructor is overridden (flash.display.BitmapData reassigned to a custom class) combined with DisplacementMapFilter usage and getPixel32 calls with a custom valueOf object.
  • Crash/exploit indicator: controlled EAX value of 0x41424344 at dereference in BitmapData.getPixel32 code path (address 6D2BFA83); monitor Flash Player crashes with EAX=0x41424344.
  • Exploit uses a large array of 0x41424344 values (0xC8/4 = 50 entries) stored in tabStops of TextFormat objects for heap manipulation — detect SWF files allocating large TextFormat arrays with identical integer tabStop values.
  • The exploit SWF requires manual byte patching at offset 0x90F — forensic analysis of suspicious SWF files should check for NOP-sled-like sequences of 0x17 (actionPOP) bytes at that offset in the AS2 bytecode.
  • ·The exploit was developed and tested against a specific Flash version (16.0.0.305) on Chrome 40.0.2214.111 on Win7 SP1 x64; crash addresses (e.g., 6D2BFA83, 6D2D3FBB) are version/ASLR-dependent and will differ across Flash builds.
  • ·The researcher noted uncertainty about ASLR bypass feasibility: the exploit may not be reliably weaponizable if a virtual function dereference is required.

CVSS provenance

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.