{"schemaVersion":3,"id":"CVE-2015-0310","aliases":["UBUNTU-CVE-2015-0310"],"status":"published","duplicateOf":null,"title":"Adobe Flash Player ASLR Bypass Vulnerability","description":"Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism on Windows, and have an unspecified impact on other platforms, via unknown vectors, as exploited in the wild in January 2015.","dates":{"published":"2015-01-23T21:00:00.000Z","modified":"2025-11-17T20:10:36.688Z","reserved":null,"kevAdded":["2022-05-25T00:00:00.000Z"],"kevDue":["2022-06-15T00:00:00.000Z"]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true}]},"epss":{"probability":0.15097,"percentile":0.9671,"severity":"medium","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.15097},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.15217,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.15217,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.15217,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.15217,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.15097,"percentile":0.9671}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.15097,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.15097,"percentile":0.9671}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-25T00:00:00.000Z","dueDate":"2022-06-15T00:00:00.000Z","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","name":"Adobe Flash Player ASLR Bypass Vulnerability","description":"Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2015-0310","label":"nvd.nist.gov/vuln/detail/CVE-2015-0310"}],"vendor":"Adobe","product":"Flash Player","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-25T00:00:00.000Z","dueDate":"2022-06-15T00:00:00.000Z","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","name":"Adobe Flash Player ASLR Bypass Vulnerability","description":"Adobe Flash Player does not properly restrict discovery of memory addresses, which allows attackers to bypass the address space layout randomization (ASLR) protection mechanism.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2015-0310","label":"nvd.nist.gov/vuln/detail/CVE-2015-0310"}],"vendor":"Adobe","product":"Flash Player","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor","description":"The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/200.html"}],"affected":[{"vendor":"adobe","product":"flash_player","name":"Flash Player","label":"flash_player","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 11.2.202.438","noFixRecorded":false,"fixedIn":null},{"text":"< 13.0.0.262","noFixRecorded":false,"fixedIn":null},{"text":"≥ 14.0, < 16.0.0.287","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.2.202.438 | < 13.0.0.262 | ≥ 14.0, < 16.0.0.287","eol":null,"hubHref":"/vendor/adobe/flash_player"},{"vendor":"ubuntu","product":"flashplugin-nonfree","name":"flashplugin-nonfree","label":"flashplugin-nonfree","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/flashplugin-nonfree","purlType":"deb","versions":[{"text":"< 11.2.202.429ubuntu0.14.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.2.202.429ubuntu0.14.04.1","eol":null,"hubHref":null}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://security.gentoo.org/glsa/glsa-201502-02.xml","label":"security.gentoo.org/glsa/glsa-201502-02.xml","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/72261","label":"www.securityfocus.com/bid/72261","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"http://secunia.com/advisories/62660","label":"secunia.com/advisories/62660","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://secunia.com/advisories/62740","label":"secunia.com/advisories/62740","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://www.securitytracker.com/id/1031609","label":"www.securitytracker.com/id/1031609","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://helpx.adobe.com/security/products/flash-player/apsb15-02.html","label":"helpx.adobe.com/security/products/flash-player/apsb15-02.html","hostname":"helpx.adobe.com","tags":["X Refsource CONFIRM","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/62452","label":"secunia.com/advisories/62452","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://secunia.com/advisories/62601","label":"secunia.com/advisories/62601","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-0310","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-0310","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","label":"github.com/cisagov/vulnrichment/issues/196","hostname":"github.com","tags":["Issue Tracking"]},{"url":"https://ubuntu.com/security/CVE-2015-0310","label":"ubuntu.com/security/CVE-2015-0310","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0310","label":"www.cve.org/CVERecord?id=CVE-2015-0310","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":["RHSA-2015:0094"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2015-01-23T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-05-25T00:00:00.000Z","label":"Added to CISA KEV","detail":"Adobe Flash Player ASLR Bypass Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-06-15T00:00:00.000Z","label":"CISA remediation due","detail":"The impacted product is end-of-life and should be disconnected if still in use.","source":"cisa"},{"kind":"modified","date":"2025-11-17T20:10:36.688Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T11:34:23.350Z","stale":false,"partial":false}}