Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Adobe Flash Player and AIR can bypass security restrictions

CVE-2015-3116 · published 11 years ago
Summary

Versions of Adobe Flash Player, Adobe AIR, and the AIR development kits for Windows, macOS and Linux may let a remote attacker get around the web browser’s same‑origin protection. This could allow malicious content from one site to interact with data from another site. Update to the latest releases of Flash Player, AIR, and the AIR SDK to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe flash_player <= 13.0.0.289
14.0.0.125
14.0.0.145
14.0.0.176
14.0.0.179
15.0.0.152
15.0.0.167
15.0.0.189
15.0.0.223
15.0.0.239
15.0.0.246
16.0.0.235
10 more version ranges
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe air <= 18.0.0.144
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
adobe air_sdk <= 18.0.0.144
cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
adobe air_sdk_\&_compiler <= 18.0.0.144
cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
Original advisory text
Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and ...
Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3125, and CVE-2015-5116.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
4% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published9 Jul 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-3116 · NVD
Track software like this
Free during beta