Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Adobe Flash Player and AIR permit remote code execution

CVE-2015-5575 · published 11 years ago
Summary

Older versions of Adobe Flash Player and Adobe AIR on Windows, macOS, Linux, and Android can be tricked into running malicious code or crashing. This could let attackers take control of a system or cause it to stop working. Update to the latest versions of Flash Player and AIR to protect your computers.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe air <= 18.0.0.143
<= 18.0.0.199
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
google android All versions
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
adobe flash_player <= 13.0.0.289
14.0.0.125
14.0.0.145
14.0.0.176
14.0.0.179
15.0.0.152
15.0.0.167
15.0.0.189
15.0.0.223
15.0.0.239
15.0.0.246
16.0.0.235
14 more version ranges
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe air_sdk <= 18.0.0.199
cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
adobe air_sdk_\&_compiler <= 18.0.0.180
cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
Original advisory text
Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK...
Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5577, CVE-2015-5578, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
4% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published22 Sep 2015
Updated24 Oct 2026
First seen29 Sep 2026
Sources
CVE-2015-5575 · NVD
Track software like this
Free during beta