Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-3077: Adobe Flash Player and AIR let attackers run code

CVE-2015-3077 · published 11 years ago

Summary

Old versions of Adobe Flash Player, Adobe AIR and its SDK on Windows, macOS, and Linux can be tricked into running any program an attacker chooses. This could let a malicious website or file take control of the computer. Upgrade to the latest releases of Flash Player and AIR, or uninstall them if they are no longer needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
adobe	flash_player	<= 11.2.202.475 <= 13.0.0.264 14.0.0.125 14.0.0.145 14.0.0.176 14.0.0.179 15.0.0.152 15.0.0.167 15.0.0.189 15.0.0.223 15.0.0.239 15.0.0.246 6 more version ranges `cpe:2.3:a:adobe:flash_player::::::::`
adobe	air	<= 17.0.0.144 `cpe:2.3:a:adobe:air::::::::`
adobe	air_sdk	<= 17.0.0.144 `cpe:2.3:a:adobe:air_sdk::::::::`
adobe	air_sdk_\&_compiler	<= 17.0.0.144 `cpe:2.3:a:adobe:air_sdk_\&_compiler::::::::`

Original advisory text

Adobe Flash Player before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X and before 11.2.202.460 on Linux, Adobe AIR before 17.0.0.172, Adobe AIR SDK before 17.0.0.172, and Adobe AIR SDK & Compiler before 17.0.0.172 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion," a different vulnerability than CVE-2015-3084 and CVE-2015-3086.

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

15% chance of attack within 30 days

Timeline

Published13 May 2015

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2015-3077 · NVD

Track software like this

Free during beta