CVE-2015-3090 Public exploit EPSS 83.2%

Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before…

Summary

Adobe Flash Player (before 13.0.0.289, 14.x through 17.x before 17.0.0.188 on Windows and OS X, and before 11.2.202.460 on Linux), along with Adobe AIR and the Adobe AIR SDK and SDK & Compiler (before 17.0.0.172), contains a memory corruption flaw in its handling of content. An attacker can exploit it through unspecified vectors to execute arbitrary code or cause a denial of service.

Official description · CVE.org

Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3078, CVE-2015-3089, and CVE-2015-3093.

Breakdown

65.4 / 100

Exploited: Yes, in VulnCheck KEV
Reports: 1
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Infect visitors through a malicious websiteT1189 · Drive-by CompromiseAI-written (claude-haiku-5-5)Medium confidence3 general detection rules
What they do
- Run code when a user opens a file or pageT1203 · Exploitation for Client ExecutionAI-written (claude-haiku-5-5)Medium confidence35 general detection rules
- Crash the applicationT1499.004 · Application or System ExploitationAI-written (claude-haiku-5-5)Medium confidence3 general detection rules

First seen exploited 3 months after disclosure. Public exploit code (Metasploit) was available 1 day before disclosure.

Public exploit codeMetasploit12 May 20151 day before
Disclosed13 May 2015day 0
First seen exploitedVulnCheck KEV evidence30 Jul 2015+3 mo

techniques

3 , grouped by in kill-chain order, 3 cited passages 3

Initial AccessTA0001

Drive-by Compromise T1189 Medium

AI mapping from the description · how it is exploited

Flash content delivered via browser exploitation

allow attackers to execute arbitrary code or cause a denial of service

From the official description (CVE.org) Original ↗

ExecutionTA0002

Exploitation for Client Execution T1203 Medium

AI mapping from the description · primary impact

Exploits client-side Flash Player code execution

allow attackers to execute arbitrary code or cause a denial of service

From the official description (CVE.org) Original ↗

ImpactTA0040

Application or System Exploitation T1499.004 Medium

AI mapping from the description · primary impact

Memory corruption can crash the application

cause a denial of service (memory corruption)

From the official description (CVE.org) Original ↗

Detection

0 rules for this CVE · 41 general rules for its techniques

Rules for this CVE

0 that reference CVE-2015-3090 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules

Cross Site Scripting Stringshightest
Flash Player Update from Suspicious Locationhightest
Suspicious Browser Child Process - MacOSmediumtest

Exploitation for Client ExecutionT120335 general rules

Antivirus - Exploitation Framework Signaturecriticalstable
Droppers Exploiting CVE-2017-11882criticalstable
Audit CVE Eventcriticaltest
CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
Exploit for CVE-2017-8759criticaltest
Antivirus - APT Malware Signaturecriticalexperimental
Antivirus - Remote Access Tools Signaturecriticalexperimental

All 35 on SigmaHQ ↗

Application or System ExploitationT1499.0043 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report

1 reportMicrosoft

Reports are matched by finding the exact id CVE-2015-3090 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

MicrosoftUndated

Microsoft Security

Flash Player APSB15-02 Angler (JS/Axpergle) CVE-2015-0311 Adobe Flash Player APSB15-03 Angler CVE-2015-0313 Adobe Flash Player APSB15-04 Angler CVE-2015-0336 Adobe Flash Player APSB15-05 Nuclear (JS/Neclu); Angler CVE-2015-0359 Adobe Flash Player APSB15-06 Angler CVE-2015-3090 Adobe Flash Player APSB15-09…

2 passages name itOriginal (opens in a new tab) ↗

Also mentioned in 4 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows13 Jun 2024
Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'11 Jun 2024
Operation Rocket Man22 Aug 2018
Angler EK Exploiting Adobe Flash CVE-2015-309027 May 2015

References

8 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2015-3171

Adobe Flash Player - ShaderJob Buffer Overflow (Metasploit)EDB-37368 · remote · multiple · 2015-06-24 · verified

, 30 Oct 2026

83.2%Top 0.32%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.68%).

No CVSS score published.

Priority factorsFormula

In a KEV cataloglisted in VulnCheck KEV 35.0/35

Recent KEV listingadded 4111 days ago 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9968 19.9/20

Threat reports1 report 3.9/10

Public exploit code1 Exploit-DB entry; 1 PoC-in-GitHub repo; 1 Metasploit module 5.0/5

Mentioned in OTX pulses4 pulses 1.6/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total65.4

Record

Published: 13 May 2015
Modified: 6 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Initial AccessTA0001

ExecutionTA0002

ImpactTA0040

Detection

Rules for this CVE

General rules for this CVE’s techniques

What security researchers reported

Microsoft Security

Also mentioned in 4 community threat pulses (AlienVault OTX)

References

vdb-entry 2

vendor-advisory 5

x_refsource_CONFIRM 1

How attackers get in

What they do

techniques