CVE-2015-8447 describes a use-after-free vulnerability within the Color object implementation of Adobe Flash Player, Adobe AIR, and related SDKs. This flaw affects various versions across Windows, OS X, and Linux. An attacker can exploit this vulnerability by crafting specific setTransform arguments, leading to arbitrary code execution on affected systems. The vulnerability carries a critical CVSS score of 9.3, indicating a high-impact threat. It can be exploited remotely with medium attack complexity, allowing an unauthenticated attacker to achieve complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation (KEV: No) or public exploit code (Metasploit, Nuclei, ExploitDB: None), the vulnerability received some community discussion and media coverage at the time of its disclosure. Adobe released patches to address this and numerous other vulnerabilities in a significant update.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 18.0.0.261CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* | ||
19.0.0.185CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.185:*:*:*:*:*:*:* | ||
19.0.0.207CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.207:*:*:*:*:*:*:* | ||
19.0.0.226CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.226:*:*:*:*:*:*:* | ||
19.0.0.245CPE matchmatch criteria | cpe:2.3:a:adobe:flash_player:19.0.0.245:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.