CVE-2015-8634: adobe air
Vulnerability summary
CVE-2015-8634 is a high (CVSS 9.3) vulnerability in adobe air. EPSS estimates a 25.47% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 4 · Related 2Timeline
- 28-12-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8635, CVE-2015-8638, CVE-2015-8639, CVE-2015-8640, CVE-2015-8641, CVE-2015-8642, CVE-2015-8643, CVE-2015-8646, CVE-2015-8647, CVE-2015-8648, CVE-2015-8649, and CVE-2015-8650.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
25.47%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 25.47% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAdobe Flash - Use-After-Free When Setting Stage
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Adobe4 products
- air≤ 20.0.0.204
- air_sdk≤ 20.0.0.204
- air_sdk_\&_compiler≤ 20.0.0.204
- flash_player≤ 18.0.0.268 | 19.0.0.185 | 19.0.0.207 | 19.0.0.226 | 19.0.0.245 | 20.0.0.228 | 20.0.0.235 | ≤ 11.2.202.554
Ubuntu1 product
- flashplugin-nonfree< 11.2.202.559ubuntu0.14.04.1
2 vendors · 5 products
References
14 links- helpx.adobe.com/security/products/flash-player/apsb16-01.htmlX Refsource CONFIRMPatchVendor AdvisoryREPORT