CVE-2015-0310
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
The impacted product is end-of-life and should be disconnected if still in use.
Adobe Flash Player fails to properly hide memory addresses, allowing attackers to bypass ASLR (a security protection that randomizes where programs load in memory). This makes it easier for attackers to exploit other vulnerabilities in Flash.
The vulnerability stems from improper memory address disclosure in affected Flash Player versions, enabling ASLR bypass on Windows and unspecified impacts on OS X and Linux. Exploitation requires unknown attack vectors and was actively leveraged in-the-wild campaigns in January 2015.
The full analysis of this CVE is available in Portuguese →