CVE-2015-3106
published 2015-06-10CVE-2015-3106: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on…
PriorityP270critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
43.45%
98.7th percentile
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3107.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | air | <= 17.0.0.172 | — |
| adobe | air | <= 17.0.0.144 | — |
| adobe | air_sdk | <= 17.0.0.172 | — |
| adobe | air_sdk_compiler | <= 17.0.0.172 | — |
| adobe | flash_player | <= 11.2.202.460 | — |
| adobe | flash_player | <= 13.0.0.289 | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| opensuse | evergreen | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The exploit triggers a use-after-free in ActionScript 2 via TextField.filters array manipulation: overriding flash.filters.GlowFilter with a custom constructor class (MyGlowFilter/MyGlowFilter2) that re-reads and then clears tfield.filters during the clone loop, freeing the internal filter array while a stack reference remains live. ↗
- →The bypass of Flash 17's 'in-use' flag protection involves a two-level GlowFilter constructor override: the first override (MyGlowFilter) sets the flag to 1, then immediately triggers a second override (MyGlowFilter2) which sets the flag to 1 and then back to 0, allowing the filter to be freed via tfield.filters = []. ↗
- →Heap spray pattern: the PoC allocates 0x200 TextFormat objects and sets their tabStops to an array filled with the canary value 0x41424344 (repeated 0x50/4 times) to control freed memory and confirm exploitation via crash at that address. ↗
- ·The vulnerability affects ActionScript 2 (AS2) only; the TextField.filters UAF trigger relies on AS2's ability to override filter constructors at runtime, which is not present in AS3. ↗
- ·Flash 17.0.0.169 introduced a partial mitigation ('in-use' flag at [esi+0Ch]) that the PoC explicitly bypasses via the two-level constructor override; detections relying solely on the flag mechanism will not catch this bypass. ↗
- ·The PoC was confirmed on Flash Player standalone 17.0.0.169 on Windows 7 x64 SP1; Chrome's updated Flash was not available at time of writing but the researcher expected the same crash behavior. ↗
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv10.0CRITICAL
vendor_redhat10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qxgg-wx3x-5qx8: Use-after-free vulnerability in Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2015-3107 [CRITICAL] CWE-416 GHSA-qxgg-wx3x-5qx8: Use-after-free vulnerability in Adobe Flash Player before 13
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3106.
GHSA
GHSA-v3gx-624q-2q65: Use-after-free vulnerability in Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2015-3103 [CRITICAL] GHSA-v3gx-624q-2q65: Use-after-free vulnerability in Adobe Flash Player before 13
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3106 and CVE-2015-3107.
GHSA
GHSA-63h7-3rm7-hf84: Use-after-free vulnerability in Adobe Flash Player before 13
ghsa_unreviewed·2022-05-17·CVSS 10.0
CVE-2015-3106 [CRITICAL] GHSA-63h7-3rm7-hf84: Use-after-free vulnerability in Adobe Flash Player before 13
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3107.
OSV
CVE-2015-3106: Use-after-free vulnerability in Adobe Flash Player before 13
osv·2015-06-10·CVSS 10.0
CVE-2015-3106 [CRITICAL] CVE-2015-3106: Use-after-free vulnerability in Adobe Flash Player before 13
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3107.
OSV
CVE-2015-3103: Use-after-free vulnerability in Adobe Flash Player before 13
osv·2015-06-10·CVSS 10.0
CVE-2015-3103 [CRITICAL] CVE-2015-3103: Use-after-free vulnerability in Adobe Flash Player before 13
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3106 and CVE-2015-3107.
OSV
CVE-2015-3107: Use-after-free vulnerability in Adobe Flash Player before 13
osv·2015-06-10·CVSS 10.0
CVE-2015-3107 [CRITICAL] CVE-2015-3107: Use-after-free vulnerability in Adobe Flash Player before 13
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3106.
Red Hat
flash-plugin: multiple code execution issues fixed in APSB15-11
vendor_redhat·2015-06-09·CVSS 10.0
CVE-2015-3103 [CRITICAL] flash-plugin: multiple code execution issues fixed in APSB15-11
flash-plugin: multiple code execution issues fixed in APSB15-11
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3106 and CVE-2015-3107.
Red Hat
flash-plugin: multiple code execution issues fixed in APSB15-11
vendor_redhat·2015-06-09·CVSS 10.0
CVE-2015-3106 [CRITICAL] flash-plugin: multiple code execution issues fixed in APSB15-11
flash-plugin: multiple code execution issues fixed in APSB15-11
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3107.
Red Hat
flash-plugin: multiple code execution issues fixed in APSB15-11
vendor_redhat·2015-06-09·CVSS 10.0
CVE-2015-3107 [CRITICAL] flash-plugin: multiple code execution issues fixed in APSB15-11
flash-plugin: multiple code execution issues fixed in APSB15-11
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3103 and CVE-2015-3106.
No detection rules found.
Zscaler
Zscaler discovers Flash Player Vulnerabilities | 06-09-2015
blogs_zscaler
Zscaler discovers Flash Player Vulnerabilities | 06-09-2015
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Bugzilla
CVE-2015-3100 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 flash-plugin: multiple code execution issues fixed in APSB15-11
bugzilla·2015-06-09·CVSS 10.0
CVE-2015-3100 [CRITICAL] CVE-2015-3100 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 flash-plugin: multiple code execution issues fixed in APSB15-11
CVE-2015-3100 CVE-2015-3103 CVE-2015-3104 CVE-2015-3105 CVE-2015-3106 CVE-2015-3107 flash-plugin: multiple code execution issues fixed in APSB15-11
Adobe Security Bulletin APSB15-11 for Adobe Flash Player describes multiple flaws that can possibly lead to code execution when Flash Player is used to play a specially crafted SWF file.
Quoting from the APSB15-11:
These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2015-3100).
These updates resolve an integer overflow vulnerability that could lead to code execution (CVE-2015-3104).
These updates resolve a memory corruption vulnerability that could lead to code execution (CVE-2015-3105).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-3103, CVE-2015-3
http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1086.htmlhttp://www.securityfocus.com/bid/75087http://www.securitytracker.com/id/1032519https://helpx.adobe.com/security/products/flash-player/apsb15-11.htmlhttps://security.gentoo.org/glsa/201506-01https://www.exploit-db.com/exploits/37847/http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00009.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-06/msg00011.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1086.htmlhttp://www.securityfocus.com/bid/75087http://www.securitytracker.com/id/1032519https://helpx.adobe.com/security/products/flash-player/apsb15-11.htmlhttps://security.gentoo.org/glsa/201506-01https://www.exploit-db.com/exploits/37847/
2015-06-10
Published