CVE-2015-3113
Adobe Flash Player Heap-Based Buffer Overflow Vulnerability
Description
CVE-2015-3113 is a heap-based buffer overflow vulnerability in Adobe Flash Player that allows a remote attacker to execute arbitrary code on the victim's system by delivering specially crafted Flash content. The vulnerability was exploited in the wild as a zero-day by the APT3 threat group (also known as UPS) in targeted phishing campaigns before a patch was available. CISA has added CVE-2015-3113 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 97.4% (99.9th percentile), this vulnerability is among the most exploited Flash Player vulnerabilities globally.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| adobe | flash player | < 13.0.0.296; >= 14.0.0.125, < 18.0.0.194; < 11.2.202.468 |
| opensuse | evergreen | 11.4 |
| opensuse | opensuse | 13.1; 13.2 |
| suse | linux enterprise desktop | 12 |
| suse | linux enterprise workstation extension | 12 |
| hp | insight orchestration | < 7.5.0 |
| hp | system management homepage | < 7.5.0 |
| hp | systems insight manager | < 7.5 |
| hp | version control agent | < 7.5.0 |
| hp | version control repository manager | < 7.5.0; 7.6 |
| hp | virtual connect enterprise manager | < 7.5.0 |
| redhat | enterprise linux desktop | 6.0 |
| redhat | enterprise linux eus | 6.6 |
| redhat | enterprise linux server | 6.0 |
| redhat | enterprise linux workstation | 6.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00020.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00025.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00002.html(Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=144050155601375&w=2(Mailing List)
- http://rhn.redhat.com/errata/RHSA-2015-1184.html(Third Party Advisory)
- http://www.securityfocus.com/bid/75371(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1032696(Broken Link, Third Party Advisory, VDB Entry)
- https://bugzilla.redhat.com/show_bug.cgi?id=1235036(Issue Tracking)
- https://bugzilla.suse.com/show_bug.cgi?id=935701(Issue Tracking)
- https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952467(Broken Link)
- https://helpx.adobe.com/security/products/flash-player/apsb15-14.html(Broken Link, Patch, Vendor Advisory)
- https://security.gentoo.org/glsa/201507-13(Third Party Advisory)
- https://www.suse.com/security/cve/CVE-2015-3113.html(Third Party Advisory)
- https://github.com/cisagov/vulnrichment/issues/196(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3113(US Government Resource)
Weakness Type
CWE-122: Heap-based Buffer Overflow
CWE-122 describes a weakness where a buffer overflow occurs in the heap data area, typically due to writing more data to a heap-allocated buffer than it can hold. In CVE-2015-3113, Adobe Flash Player contains a heap-based buffer overflow that is triggered when processing specially crafted Flash content, allowing an attacker to overwrite adjacent heap memory and redirect code execution to attacker-controlled payloads.
Learn more: CWE-122 — Heap-based Buffer Overflow
Impact Analysis
CVE-2015-3113 enables full remote code execution through the browser, requiring only that the victim view a web page or email containing malicious Flash content. The confidentiality, integrity, and availability of the target system are completely compromised, as the attacker gains arbitrary code execution at the privilege level of the browser process. The vulnerability's use by APT3 for targeted espionage campaigns demonstrates its effectiveness as a precision weapon against high-value targets in aerospace, defense, and technology sectors. The heap overflow also made this vulnerability reliable across different system configurations, enhancing its value as an exploitation tool.
Exploit Maturity
CVE-2015-3113 was exploited as a zero-day by the APT3 group in targeted phishing campaigns against organizations in the aerospace and defense sectors before any patch was available. The EPSS score of 97.4% (99.9th percentile) confirms near-certain exploitation probability. After disclosure, the vulnerability was rapidly integrated into commercial exploit kits for mass exploitation. The combination of nation-state zero-day usage and subsequent criminal adoption represents the most advanced exploit maturity profile.
Remediation
- Remove Adobe Flash Player entirely as required by CISA KEV — Flash Player reached end of life on December 31, 2020, and no longer receives security updates.
- Verify complete removal of Flash Player from all systems, including browser plugins and standalone installations.
- Block Flash content at network perimeters and in browser policies to prevent residual exposure.
- For organizations with legacy Flash dependencies, implement strict application sandboxing and network isolation.
- Conduct forensic review of systems that ran Flash Player during the active exploitation period (June-July 2015) for indicators of APT3 or related threat group activity.
Technical Details
CVE-2015-3113 is a heap-based buffer overflow in Adobe Flash Player triggered by malformed FLV (Flash Video) data embedded in SWF content. When the Flash Player processes the crafted FLV stream, it allocates a heap buffer that is insufficient for the incoming data, causing a write beyond the buffer boundary. The attacker carefully controls the overflow data to overwrite adjacent heap metadata or function pointers, enabling redirection of program execution to shellcode placed in a predictable heap location through heap spray techniques. The exploitation requires no user interaction beyond rendering the Flash content in a browser, and APT3 delivered the exploit through spear-phishing emails with links to attacker-controlled web servers.
Frequently Asked Questions
Is CVE-2015-3113 being actively exploited?
Yes. CVE-2015-3113 was exploited as a zero-day by APT3 and subsequently integrated into exploit kits. It is listed in the CISA KEV catalog with a 99.9th percentile EPSS score.
What products are affected by CVE-2015-3113?
CVE-2015-3113 affects Adobe Flash Player across all supported platforms. Flash Player is end-of-life and should be completely removed from all systems.
How do I fix CVE-2015-3113?
Remove Adobe Flash Player entirely. No patches are available as Flash Player has been discontinued. Block Flash content in all browsers and at network perimeters.
How severe is CVE-2015-3113?
CVE-2015-3113 is a critical heap buffer overflow enabling remote code execution through web browsing. It was used as a zero-day by a nation-state threat group for targeted espionage, confirming its severity as a weapon-grade vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.