CVE-2015-4430

published 2015-07-09

CVE-2015-4430: Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on…

Priority P2 63 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-5117.

Affected

25 ranges

Vendor	Product	Version range	Fixed in
adobe	air	<= 18.0.0.144	—
adobe	air_sdk	<= 18.0.0.144	—
adobe	air_sdk_compiler	<= 18.0.0.144	—
adobe	flash_player	<= 11.2.202.468	—
adobe	flash_player	<= 13.0.0.289	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—

Detection & IOCs extracted from sources · hover to see the quote

filename 2038518113_crash.swf↗

filename 2038518113_min.swf↗

filename 2038518113_orig.swf↗

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37875.zip↗

• → Crash occurs at Flash32_17_0_0_188+0x18cb (instruction: jmp dword ptr [eax+0x4]) with access violation code c0000005; monitor for Flash process crashes at this offset pattern indicative of use-after-free via URL sub-resource loading. ↗
• → Exploitation observed specifically on Windows 7 with IE11; does not immediately reproduce on Windows+Chrome or Linux+Chrome — prioritize IE11/Flash telemetry on Windows 7 endpoints for detection. ↗
• → Vulnerability is a use-after-free triggered by loading a sub-resource from a URL within a SWF file; inspect SWF files loading external URL resources for anomalous memory access patterns. ↗

• · Affected versions span a wide range: Flash Player before 13.0.0.302, 14.x–18.x before 18.0.0.203 (Windows/OS X), before 11.2.202.481 (Linux); Adobe AIR/SDK/Compiler before 18.0.0.180 — ensure version scoping is correct when writing version-based detection rules. ↗
• · CVE-2015-4430 is one of multiple distinct use-after-free vulnerabilities sharing the same affected version ranges and patch; do not conflate detection signatures with CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-5117. ↗

CVSS provenance

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

osv 10.0 CRITICAL

vendor_redhat 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.