Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Adobe Flash Player and AIR may let attackers run code

CVE-2015-8044 · published 10 years ago
Summary

Older versions of Adobe Flash Player, Adobe AIR and related development tools can be tricked into running any program an attacker chooses. This could let a malicious website or file take control of the computer. Update to the latest versions of Flash Player, AIR, and the AIR SDK to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
adobe air <= 19.0.0.213
<= 19.0.0.190
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
adobe flash_player <= 11.2.202.540
<= 18.0.0.255
19.0.0.185
19.0.0.207
19.0.0.226
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
adobe air_sdk <= 19.0.0.213
cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
adobe air_sdk_\&_compiler <= 19.0.0.213
cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
Original advisory text
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK befo...
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X and before 11.2.202.548 on Linux, Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7651, CVE-2015-7652, CVE-2015-7653, CVE-2015-7654, CVE-2015-7655, CVE-2015-7656, CVE-2015-7657, CVE-2015-7658, CVE-2015-7660, CVE-2015-7661, CVE-2015-7663, CVE-2015-8042, CVE-2015-8043, and CVE-2015-8046.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
41% chance of attack within 30 days
Timeline
Published11 Nov 2015
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2015-8044 · NVD
Track software like this
Free during beta