CVE-2015-5123
Adobe Flash Player Use-After-Free Vulnerability
Description
CVE-2015-5123 is a use-after-free vulnerability in Adobe Flash Player that allows a remote attacker to execute arbitrary code on the victim's system by delivering specially crafted Flash content through a web browser. The vulnerability was disclosed as part of the Hacking Team data breach in 2015 and was being actively exploited as a zero-day before a patch was available. CISA has added CVE-2015-5123 to the Known Exploited Vulnerabilities catalog. With an EPSS score of 97.3% (99.9th percentile), this vulnerability represents one of the most exploited Flash Player vulnerabilities in history.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| redhat | enterprise linux desktop | 5.0; 6.0 |
| redhat | enterprise linux server | 5.0; 6.0 |
| redhat | enterprise linux server eus | 6.6 |
| redhat | enterprise linux workstation | 5.0; 6.0 |
| opensuse | evergreen | 11.4 |
| suse | linux enterprise desktop | 11; 12 |
| suse | linux enterprise workstation extension | 12 |
| adobe | flash player | >= 11.0, <= 11.2.202.481; >= 13.0, <= 13.0.0.302; >= 18.0, <= 18.0.0.203 |
| adobe | flash player desktop runtime | >= 18.0, <= 18.0.0.203 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://blog.trendmicro.com/trendlabs-security-intelligence/new-zero-day-vulnerability-cve-2015-5123-in-adobe-flash-emerges-from-hacking-team-leak/(Broken Link, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00028.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00029.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00032.html(Mailing List, Third Party Advisory)
- http://marc.info/?l=bugtraq&m=144050155601375&w=2(Mailing List, Third Party Advisory)
- http://rhn.redhat.com/errata/RHSA-2015-1235.html(Third Party Advisory)
- http://www.kb.cert.org/vuls/id/918568(Third Party Advisory, US Government Resource)
- http://www.securityfocus.com/bid/75710(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1032890(Broken Link, Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/ncas/alerts/TA15-195A(Third Party Advisory, US Government Resource)
- https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04796784(Broken Link, Third Party Advisory)
- https://helpx.adobe.com/security/products/flash-player/apsa15-04.html(Broken Link, Vendor Advisory)
- https://helpx.adobe.com/security/products/flash-player/apsb15-18.html(Broken Link, Vendor Advisory)
- https://security.gentoo.org/glsa/201508-01(Third Party Advisory)
- https://github.com/cisagov/vulnrichment/issues/196(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5123(US Government Resource)
Weakness Type
CWE-416: Use After Free
CWE-416 describes a weakness where software references memory after it has been freed, which can lead to program crashes, arbitrary code execution, or other unexpected behavior. In CVE-2015-5123, Adobe Flash Player contains a use-after-free condition in the DisplayObject class that can be triggered by specially crafted Flash content, causing the Flash Player to reference freed memory and enabling an attacker to execute arbitrary code.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2015-5123 enables full remote code execution through the browser, requiring only that the victim visit a web page or view an advertisement containing malicious Flash content. The confidentiality impact is complete — the attacker's code runs with the user's privileges and can access all files, credentials, and data on the system. The integrity impact is equally total, enabling installation of malware, backdoors, and rootkits. Availability can be fully compromised through ransomware or destructive payloads. The zero-click exploitation model through web browsing and the pre-patch exploitation by the Hacking Team demonstrate the severity of this vulnerability as a weapon for targeted surveillance and mass exploitation campaigns.
Exploit Maturity
CVE-2015-5123 was exploited as a zero-day vulnerability before a patch existed, having been discovered in the leaked Hacking Team arsenal in July 2015. The EPSS score of 97.3% (99.9th percentile) confirms it as one of the most exploited Flash Player vulnerabilities globally. Multiple exploit kits integrated this vulnerability for drive-by download campaigns, and nation-state actors used it for targeted surveillance operations. The wide availability of exploit code and the ubiquity of Flash Player at the time of disclosure made this vulnerability a primary attack vector for years.
Remediation
- Remove Adobe Flash Player entirely as required by CISA KEV and Adobe's own end-of-life guidance — Flash Player reached end of life on December 31, 2020, and no longer receives security updates.
- Verify that Flash Player has been removed from all systems, including legacy installations that may have been overlooked during migration.
- Configure web browsers to block Flash content and ensure browser-embedded Flash plugins are disabled.
- For legacy applications that require Flash, implement application isolation through virtual machines or containers with no network access to sensitive resources.
- Audit systems that previously ran Flash Player for residual malware or persistent access that may have been established through exploitation of this or similar Flash vulnerabilities.
Technical Details
CVE-2015-5123 is a use-after-free vulnerability in the Adobe Flash Player DisplayObject class implementation. When specially crafted ActionScript code triggers specific object lifecycle operations, the Flash Player frees a DisplayObject memory allocation but retains a reference to the freed memory location. Subsequent access to this dangling pointer allows the attacker to control the contents of the reallocated memory, enabling heap spray techniques to redirect execution flow to attacker-controlled shellcode. The vulnerability is triggered through embedded SWF content processed by the Flash Player browser plugin, requiring no user interaction beyond visiting the hosting web page.
Frequently Asked Questions
Is CVE-2015-5123 being actively exploited?
Yes. CVE-2015-5123 was originally exploited as a zero-day by the Hacking Team and subsequently integrated into multiple exploit kits. It is listed in the CISA KEV catalog with a 99.9th percentile EPSS score.
What products are affected by CVE-2015-5123?
CVE-2015-5123 affects Adobe Flash Player across all platforms, including Windows, macOS, and Linux. Flash Player reached end of life in December 2020 and should be completely removed from all systems.
How do I fix CVE-2015-5123?
Remove Adobe Flash Player entirely from all systems. Flash Player is end-of-life and no longer receives security updates. Block Flash content in all web browsers.
How severe is CVE-2015-5123?
CVE-2015-5123 is a critical remote code execution vulnerability that was exploited as a zero-day. Its 99.9th percentile EPSS score confirms it as one of the most exploited Flash vulnerabilities. The primary remediation is complete removal of Flash Player.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.