Security Resilience

CVE-2015-0311

Adobe Flash Player ≤ 11.2.202.438

CISA KEVActive ExploitationEUVD Exploited
Published
23 January 2015
Modified
21 April 2026
KEV Added
13 April 2022
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.86 99.7th percentile
Risk Priority 97 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2015-0311 is a critical-severity an unspecified weakness vulnerability in Adobe Flash Player. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Adobe Flash Player contains an unspecified vulnerability affecting versions through 13.0.0.262 as well as 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X, and through 11.2.202.438 on Linux. The flaw permits remote code execution and carries a CVSS 3.1 base score of 9.8.

Remote attackers can exploit the issue over the network without authentication or user interaction beyond normal rendering of Flash content, achieving arbitrary code execution on affected systems. The vulnerability was observed being exploited in the wild during January 2015.

Adobe addressed the issue in security bulletins APSA15-01 and APSB15-03, which describe the availability of updated Flash Player builds for the supported platforms. Additional vendor advisories from distributions such as openSUSE provide corresponding package updates.

EU & UK References

Vulnerability Data

Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild…

more

in January 2015.

CWE(s)
NVD-CWE-noinfo
KEV Date Added
13 April 2022

Related Threats

CVEs Like This One

CVE-2015-0313Same product: Adobe Flash Playerboth on KEV
CVE-2015-0310Same product: Adobe Flash Playerboth on KEV
CVE-2014-9163Same product: Adobe Flash Playerboth on KEV
CVE-2015-5122Same product: Adobe Flash Playerboth on KEV
CVE-2014-8439Same product: Adobe Flash Playerboth on KEV
CVE-2015-7645Same product: Adobe Flash Playerboth on KEV
CVE-2012-1535Same product: Adobe Flash Playerboth on KEV
CVE-2015-5119Same product: Adobe Flash Playerboth on KEV
CVE-2016-4171Same product: Adobe Flash Playerboth on KEV
CVE-2016-7855Same product: Adobe Flash Playerboth on KEV

Affected Assets

adobe
flash player
≤ 11.2.202.438 · ≤ 13.0.0.262 · 14.0.0.125 — 16.0.0.287
suse
linux enterprise desktop
11, 12
suse
linux enterprise workstation extension
12
microsoft
internet explorer
10, 11
microsoft
edge
all versions

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References