Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Adobe Flash Player and AIR may let attackers run code

CVE-2015-5556 · published 11 years ago
Summary

Older versions of Adobe Flash Player, Adobe AIR, and the AIR development tools can be tricked into running malicious programs. This could let a hacker take control of a computer or steal data. Update to the latest versions of these Adobe products as soon as possible to protect your systems.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe air <= 18.0.0.180
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
adobe air_sdk <= 18.0.0.180
cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
adobe air_sdk_\&_compiler <= 18.0.0.180
cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
adobe flash_player <= 18.0.0.209
<= 11.2.202.491
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
Original advisory text
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AI...
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
45% chance of attack within 30 days
Timeline
Published14 Aug 2015
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2015-5556 · NVD
Track software like this
Free during beta