Microsoft Security
CVE-2015-0336 Adobe Flash Player APSB15-05 Nuclear (JS/Neclu); Angler…
3 passages name itOriginal (opens in a new tab) ↗
CVE-2015-0336 Public exploit EPSS 70.4%
Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before…
Summary
Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux is affected by a type confusion vulnerability that allows attackers to execute arbitrary code.
Official description · CVE.org
Adobe Flash Player before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X and before 11.2.202.451 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-0334.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
65.7 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 1
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 3 months after disclosure. Public exploit code (Metasploit) was available 1 day before disclosure.
- Public exploit codeMetasploit1 day before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+3 mo
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order, 2 cited passages 2Initial AccessTA0001
Drive-by Compromise T1189 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
AI mapping from the description · how it is exploited
Flash content delivered via browser, drive-by exploitation
allows attackers to execute arbitrary code
ExecutionTA0002
Exploitation for Client Execution T1203 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
AI mapping from the description · primary impact
Arbitrary code runs inside Flash client application
allows attackers to execute arbitrary code
Detection
0 rules for this CVE · 38 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2015-0336 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Drive-by CompromiseT11893 general rules
Exploitation for Client ExecutionT120335 general rules
- Antivirus - Exploitation Framework Signaturecriticalstable
- Droppers Exploiting CVE-2017-11882criticalstable
- Audit CVE Eventcriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
- Exploit for CVE-2017-8759criticaltest
- Antivirus - APT Malware Signaturecriticalexperimental
- Antivirus - Remote Access Tools Signaturecriticalexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Named in 1 threat report1 reportMicrosoft
Reports are matched by finding the exact id CVE-2015-0336 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 6 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows13 Jun 2024
- Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'11 Jun 2024
- Log4j12 Jan 2022
- Ransomware: Night Sky12 Jan 2022
- Infected Korean Website Installs Banking Malware29 Sep 2015
- Angler EK Exploiting Adobe Flash CVE-2015-309027 May 2015