CVE-2015-7645
published 2015-10-15CVE-2015-7645: Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to…
PriorityP192high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-03-24
Exploited in the wild
EPSS
65.34%
99.3th percentile
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | flash_player | <= 11.2.202.535 | — |
| adobe | flash_player | — | — |
| adobe | flash_player | — | — |
| adobe | flash_player | 18.0.0.160 – 18.0.0.252 | — |
| opensuse | evergreen | — | — |
| opensuse | opensuse | — | — |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_from_rhui | — | — |
| redhat | enterprise_linux_server_from_rhui | — | — |
| redhat | enterprise_linux_workstation | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_workstation_extension | — | — |
Detection & IOCsextracted from sources · hover to see the quote
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv7.8HIGH
vulncheck7.8HIGH
cisa7.8HIGH
vendor_redhat7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Adobe Flash Player up to 11.2.202.535/18.0.0.252/19.0.0.207 SWF File memory corruption (APSA15-05 / EDB-38490)
vuldb·2026-04-22·CVSS 7.8
CVE-2015-7645 [HIGH] Adobe Flash Player up to 11.2.202.535/18.0.0.252/19.0.0.207 SWF File memory corruption (APSA15-05 / EDB-38490)
A vulnerability, which was classified as critical, was found in Adobe Flash Player up to 11.2.202.535/18.0.0.252/19.0.0.207. Affected by this issue is some unknown functionality of the component SWF File Handler. The manipulation results in memory corruption.
This vulnerability is identified as CVE-2015-7645. The attack can be executed remotely. Additionally, an exploit exists.
You should upgrade the affected component.
GHSA
GHSA-67j3-p5pq-jgr7: Adobe Flash Player 18
ghsa_unreviewed·2022-05-17
CVE-2015-7645 [HIGH] GHSA-67j3-p5pq-jgr7: Adobe Flash Player 18
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
OSV
CVE-2015-7645: Adobe Flash Player 18
osv·2015-10-15·CVSS 7.8
CVE-2015-7645 [HIGH] CVE-2015-7645: Adobe Flash Player 18
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
VulnCheck
Adobe Flash Player Arbitrary Code Execution Vulnerability
vulncheck·2015·CVSS 7.8
CVE-2015-7645 [HIGH] Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
Affected: Adobe Flash Player
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Known Ransomware Campaign Use: Known
Exploitation References: https://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/; https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit; https://www.cve.org/CVERecord?id=CVE-2015-7645; https://www.mcafee.com/blogs/other-blogs/mcafee-labs/teslacrypt-arrives-via-neutrino-exploit-kit/; https://www.recordedfuture.com/russian-apt-toolkits; https://unit42.paloaltonetworks.com/unit42-dealersc
CISA
Adobe Flash Player Arbitrary Code Execution Vulnerability
cisa·2022-03-03·CVSS 7.8
CVE-2015-7645 [HIGH] Adobe Flash Player Arbitrary Code Execution Vulnerability
Vulnerability: Adobe Flash Player Arbitrary Code Execution Vulnerability
Affected: Adobe Flash Player
Adobe Flash Player allows remote attackers to execute arbitrary code via a crafted SWF file.
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2015-7645
Remediation Due Date: 2022-03-24
Red Hat
flash-plugin: multiple code execution issue fixed in APSB15-27
vendor_redhat·2015-10-14·CVSS 7.8
CVE-2015-7645 [HIGH] flash-plugin: multiple code execution issue fixed in APSB15-27
flash-plugin: multiple code execution issue fixed in APSB15-27
Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.
No detection rules found.
Greynoiseio
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
blogs_greynoiseio·2026-02-02
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Unit42
Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue
blogs_unit42·2016-12-15·CVSS 7.8
[HIGH] Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue
Recently, Palo Alto Networks Unit 42 reported on a new exploitation platform that we called “DealersChoice” in use by the Sofacy group (AKA APT28, Fancy Bear, STRONTIUM, Pawn Storm, Sednit). As outlined in our original posting, the DealersChoice exploitation platform generates malicious RTF documents which in turn use embedded OLE Word documents. These embedded OLE Word documents then contain embedded Adobe Flash (.SWF) files that are designed to exploit Abode Flash vulnerabilities.
At the time of initial reporting, we found two variants:
1. Variant A: A standalone variant that included Flash exploit code packaged with a payload.
2. Variant B: A modular variant that loaded exploit code on-demand and appeared non-operational at the time.
Since that time, we have been able to collect addi
Unit42
Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue
blogs_unit42·2016-12-15·CVSS 7.8
[HIGH] Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue
Threat Research Center
Threat Research
Malware
## Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue
Robert Falcone
Bryan Lee
Published: December 15, 2016
Malware
Threat Actor Groups
Threat Research
DealersChoice
Fighting Ursa
Sofacy
Threat research
Recently, Palo Alto Networks Unit 42 reported on a new exploitation platform that we called “DealersChoice” in use by the Sofacy group (AKA APT28, Fancy Bear, STRONTIUM, Pawn Storm, Sednit). As outlined in our original posting, the DealersChoice exploitation platform generates malicious RTF documents which in turn use embedded OLE Word documents. These embedded OLE Word documents then contain embedded Adobe Flash (.SWF) files that are designed to exploit Abode Flash vulnerabilities.
At the time of initial reporting,
Zscaler
Chinese Govt. Website Compromised, Leads To Angler | Zscaler
blogs_zscaler·2015-11-03·CVSS 7.8
[HIGH] Chinese Govt. Website Compromised, Leads To Angler | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Qualys
Adobe Addresses 0-Day Vulnerability in Flash | Qualys
blogs_qualys·2015-10-16·CVSS 7.8
CVE-2015-7645 [HIGH] Adobe Addresses 0-Day Vulnerability in Flash | Qualys
Just three days after Trend Micro had notified Adobe of a 0-day vulnerability in their Flash player, Adobe addressed the flaw with a patch. APSB15-27 provides fixes for three vulnerabilities, and one of them, CVE-2015-7645, is currently being used in attacks in the wild. You should apply the update as quickly as possible as we expect the exploit to show up in ExploitKits soon, which will greatly increase the number of attacked machines.
Try to be quicker than Adobe and apply the patch in under three days.
For technical background of the vulnerability, take a look at Trend’s follow up blog post.
### Related
Qualys
Adobe Addresses 0-Day Vulnerability in Flash | Qualys
blogs_qualys·2015-10-16·CVSS 7.8
CVE-2015-7645 [HIGH] Adobe Addresses 0-Day Vulnerability in Flash | Qualys
Just three days after Trend Micro had notified Adobe of a 0-day vulnerability in their Flash player, Adobe addressed the flaw with a patch. APSB15-27 provides fixes for three vulnerabilities, and one of them, CVE-2015-7645, is currently being used in attacks in the wild. You should apply the update as quickly as possible as we expect the exploit to show up in ExploitKits soon, which will greatly increase the number of attacked machines.
Try to be quicker than Adobe and apply the patch in under three days.
For technical background of the vulnerability, take a look at Trend’s follow up blog post .
## Related content
Recorded Future
2017 Vulnerability Report: A Shift in Cybercriminal Preferences | Recorded Future
blogs_recorded_future·CVSS 7.8
[HIGH] 2017 Vulnerability Report: A Shift in Cybercriminal Preferences | Recorded Future
## New Kit, Same Player: Top 10 Vulnerabilities Used by Exploit Kits in 2016
## Key Takeaways
Adobe Flash Player provided six of the top 10 vulnerabilities used by exploit kits in 2016. Since our 2015 ranking, Flash Player’s popularity with cyber criminals remains after increased Adobe security issue mitigation efforts.
Vulnerabilities in Microsoft’s Internet Explorer, Windows, and Silverlight rounded out the top 10 vulnerabilities used by exploit kits. None of the vulnerabilities identified in last year’s report carried over to this year’s top 10.
A 2016 Internet Explorer vulnerability (CVE-2016-0189) saw the most linkage to exploit kits, notably Sundown EK which quickly adopted an exploit in July 2016.
Sundown, RIG, and Neutrino exploit kits filled the void created by Angler Exploit
Recorded Future
Microsoft Targeted by 8 of 10 Top Vulnerabilities in 2018 | Recorded Future
blogs_recorded_future
Microsoft Targeted by 8 of 10 Top Vulnerabilities in 2018 | Recorded Future
## Microsoft Targeted by 8 of 10 Top Vulnerabilities in 2018
Click here to download the complete analysis as a PDF.
This analysis focuses on an exploit kit, phishing attack, or remote access trojan co-occurrence with a vulnerability from January 1, 2018 to December 31, 2018. We analyzed thousands of sources, including code repositories, deep web forum postings, and dark web sites. This is a follow-up to our 2017 report , and the intended audience includes information security practitioners, especially those supporting vulnerability risk assessments.
## Executive Summary
Many vulnerability management practitioners face the daunting task of prioritizing vulnerabilities without adequate insight into which vulnerabilities are actively exploited by cybercriminals. Here, we’ll attempt to she
Recorded Future
Microsoft Targeted by 8 of 10 Top Vulnerabilities in 2018
blogs_recorded_future
Microsoft Targeted by 8 of 10 Top Vulnerabilities in 2018
# Microsoft Targeted by 8 of 10 Top Vulnerabilities in 2018
Click here to download the complete analysis as a PDF.
This analysis focuses on an exploit kit, phishing attack, or remote access trojan co-occurrence with a vulnerability from January 1, 2018 to December 31, 2018. We analyzed thousands of sources, including code repositories, deep web forum postings, and dark web sites. This is a follow-up to our 2017 report, and the intended audience includes information security practitioners, especially those supporting vulnerability risk assessments.
### Executive Summary
Many vulnerability management practitioners face the daunting task of prioritizing vulnerabilities without adequate insight into which vulnerabilities are actively exploited by cybercriminals. Here, we’ll attempt to shed
Zscaler
Zscaler discovers Flash Player Vulnerabilities | 10-27-2015
blogs_zscaler
Zscaler discovers Flash Player Vulnerabilities | 10-27-2015
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Recorded Future
2017 Vulnerability Report: A Shift in Cybercriminal Preferences
blogs_recorded_future·CVSS 7.8
[HIGH] 2017 Vulnerability Report: A Shift in Cybercriminal Preferences
# New Kit, Same Player: Top 10 Vulnerabilities Used by Exploit Kits in 2016
### Key Takeaways
- Adobe Flash Player provided six of the top 10 vulnerabilities used by exploit kits in 2016. Since our 2015 ranking, Flash Player’s popularity with cyber criminals remains after increased Adobe security issue mitigation efforts.
- Vulnerabilities in Microsoft’s Internet Explorer, Windows, and Silverlight rounded out the top 10 vulnerabilities used by exploit kits. None of the vulnerabilities identified in last year’s report carried over to this year’s top 10.
- A 2016 Internet Explorer vulnerability (CVE-2016-0189) saw the most linkage to exploit kits, notably Sundown EK which quickly adopted an exploit in July 2016.
- Sundown, RIG, and Neutrino exploit kits filled the void created by Angler Ex
arXiv
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
arxiv_fulltext·2025-02-12
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
Investigation of Advanced Persistent Threats Network-based Tactics, Techniques and Procedures
Almuthanna Alageel
and
Sergio Maffeis
Department of Computing
Imperial College London
London, United Kingdom
plain
plain
## Abstract
The scarcity of data and the high complexity of Advanced Persistent Threats (APTs) attacks have created challenges in comprehending their behavior and hindered the exploration of effective detection techniques.
To create an effective APT detection strategy, it is important to examine the Tactics, Techniques, and Procedures (TTPs) that have been reported by the industry. These TTPs can be difficult to classify as either malicious or legitimate. When developing an approach for the next generation of network intrusion detection systems (NIDS), it is necessary to
Bugzilla
CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27
bugzilla·2015-10-15·CVSS 7.8
CVE-2015-7645 [HIGH] CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27
CVE-2015-7645 CVE-2015-7647 CVE-2015-7648 flash-plugin: multiple code execution issue fixed in APSB15-27
Adobe Security Bulletin APSA15-05 for Adobe Flash Player describes a flaw that can possibly lead to code execution when Flash Player is used to play a specially crafted SWF file:
A critical vulnerability (CVE-2015-7645) has been identified in Adobe Flash Player 19.0.0.207 and earlier versions for Windows, Macintosh and Linux. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.
Adobe is aware of a report that an exploit for this vulnerability is being used in limited, targeted attacks. Adobe expects to make an update available during the week of October 19.
https://helpx.adobe.com/security/products/flash-player/apsa15-
http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00016.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00017.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.htmlhttp://packetstormsecurity.com/files/134009/Adobe-Flash-IExternalizable.writeExternal-Type-Confusion.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1913.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2024.htmlhttp://www.securityfocus.com/bid/77081http://www.securitytracker.com/id/1033850https://helpx.adobe.com/security/products/flash-player/apsa15-05.htmlhttps://helpx.adobe.com/security/products/flash-player/apsb15-27.htmlhttps://security.gentoo.org/glsa/201511-02https://www.exploit-db.com/exploits/38490/http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00015.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00016.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00017.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00018.htmlhttp://packetstormsecurity.com/files/134009/Adobe-Flash-IExternalizable.writeExternal-Type-Confusion.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1913.htmlhttp://rhn.redhat.com/errata/RHSA-2015-2024.htmlhttp://www.securityfocus.com/bid/77081http://www.securitytracker.com/id/1033850https://helpx.adobe.com/security/products/flash-player/apsa15-05.htmlhttps://helpx.adobe.com/security/products/flash-player/apsb15-27.htmlhttps://security.gentoo.org/glsa/201511-02https://www.exploit-db.com/exploits/38490/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-7645
2015-10-15
Published
2022-03-03
Added to CISA KEV
Exploited in the wild