CVE-2015-5131

published 2015-08-14

CVE-2015-5131: Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before…

Priority P2 71 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Buffer overflow in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5132 and CVE-2015-5133.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
adobe	air	<= 18.0.0.180	—
adobe	air_sdk	<= 18.0.0.180	—
adobe	air_sdk_compiler	<= 18.0.0.180	—
adobe	flash_player	<= 18.0.0.209	—
adobe	flash_player	<= 11.2.202.491	—
opensuse	evergreen	—	—

Detection & IOCs extracted from sources · hover to see the quote

hash 9217909125eb9174614e1368d5f07173↗

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37856.zip↗

• → Crash occurs at instruction 'mov al,byte ptr [edx+eax]' inside FlashPlayer!WinMainSandboxed+0x572f0 (offset 0x0139a657), triggered by an overly large index value in EDX relative to a dynamically allocated buffer pointed to by EAX. ↗
• → The out-of-bounds read index (EDX) originates from offset 0x3453b8 in the malicious SWF file, one byte after the EAX memory region base offset 0x3453b7. Inspect SWF files for anomalously large index values at these offsets. ↗
• → The memory region under EAX is mapped PAGE_READWRITE / MEM_PRIVATE and the out-of-bounds access lands beyond its End Address (0x078ad000), producing an access violation (code c0000005). Monitor Flash Player processes for access violations at this symbol offset. ↗
• → Reliably reproduces with Adobe Flash Player Projector for Windows and Google Chrome for Windows; prioritize detection on those platforms. ↗

• · CVE-2015-5131 is a distinct buffer overflow from CVE-2015-5132 and CVE-2015-5133, all three affecting the same Flash/AIR version ranges; ensure detections and patches target all three CVEs independently. ↗
• · The crashing sample and original PoC file differ by only 13 bytes, meaning malicious SWF files may be nearly identical to benign ones; byte-level diffing or entropy analysis may be needed to distinguish them. ↗

CVSS provenance

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

osv 10.0 CRITICAL

vendor_redhat 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119