Loading vulnerability…
Remote code execution in Adobe Flash Player
CVE-2015-0311 is a remote arbitrary code execution vulnerability in Adobe Flash Player affecting versions through 13.0.0.262, the 14.x and 15.x branches, and 16.x through 16.0.0.287 on Windows and OS X, and versions through 11.2.202.438 on Linux. The underlying defect and vulnerable function are unspecified. Attackers exploited the vulnerability in the wild in January 2015 using malicious Flash objects distributed through exploit kits and malvertising campaigns.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution on the affected system. Observed attacks used the vulnerability to install TeslaCrypt ransomware and Bedep malware. Subsequent payload activity included encryption of personal and game-related files, ad fraud, and downloading additional malware. These are consequences of the delivered malware rather than separately established effects of the Flash vulnerability.
If you can’t patch tonight, do this now.
Until patching is completed, reduce exposure by disabling or uninstalling Adobe Flash Player where not strictly required, enabling click-to-play or equivalent browser controls, and restricting execution of browser plugins in high-risk browsing contexts. Additional defensive measures include blocking malvertising-driven redirection chains, using exploit mitigation controls at the browser and endpoint level, and limiting user privileges to reduce post-exploitation impact.
Patch, then assume compromise.
Install the Adobe Flash Player security update addressing CVE-2015-0311. Flash Player 16.0.0.296 is identified as a fixed release for the 16.x branch. Version 16.0.0.287 remained vulnerable, and the earlier update addressing CVE-2015-0310 did not fix this vulnerability. Fixed versions for the other affected branches are not specified.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.