PatchTheCVECVE-2015-5123: Adobe Flash Player Use-After-Free Vulnerability
CVE-2015-5123 is a critical-severity flaw (CVSS 9.8) affecting enterprise linux desktop, enterprise linux server, enterprise linux server eus, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueO
Why this priority
- Critical severity
- EPSS top 3%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 18.8% (top 3%) |
| CISA exploited list | Yes, fix due 2022-05-04 |
| Weakness | CWE-416 |
| Published | 2015-07-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2015-5123?
enterprise linux desktop: mitigate or apply the listed mitigation; enterprise linux server: mitigate or apply the listed mitigation; enterprise linux server eus: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2015-5123 being exploited?
Yes. CVE-2015-5123 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.
What does CVE-2015-5123 affect?
CVE-2015-5123 affects enterprise linux desktop, enterprise linux server, enterprise linux server eus. Severity is critical (CVSS 9.8). Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Lin
How urgent is CVE-2015-5123?
Priority 94/100. Critical severity; EPSS top 3%: very likely to be exploited; Exploited in the wild (CISA KEV); Remotely exploitable, no login, no user action; On your watchlist
Software pages
Windows vulnerabilities · Google Chrome vulnerabilities · Adobe Flash vulnerabilities
Related CVEs
- CVE-2017-5436 HIGH 8.8 MITIGATE MITIGATE An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font
- CVE-2018-1061 MEDIUM 6.5 UPGRADE MITIGATE python before versions 2.7.15, 3.4.9, 3.5.6rc1, 3.6.5rc1 and 3.7.0 is vulnerable to catastrophic backtracking
- CVE-2018-11784 MEDIUM 4.3 UPGRADE MITIGATE When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 re
- CVE-2016-6794 MEDIUM 5.3 UPGRADE MITIGATE When a SecurityManager is configured, a web application's ability to read system properties should be controll
- CVE-2016-5388 HIGH 8.1 MITIGATE MITIGATE Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 sect