Which products and versions are affected by CVE-2015-3042?

Affected: Flash Player (Adobe) versions 14.0.0.125, 14.0.0.145, 14.0.0.176, 14.0.0.179, 15.0.0.152, 15.0.0.167, 15.0.0.189, 15.0.0.223; Opensuse versions 13.1, 13.2; Enterprise Linux Desktop Supplementary (Redhat) versions 5.0, 6.0, among others. The full list is in the CVE brief.

Is CVE-2015-3042 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2015-3042 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2015-3042?

Public exploit code is available.

Is there a fix for CVE-2015-3042?

Fixed versions are available, including Flash Player 11.2.202.451, Flash Player 11.2.202.418-0.3.1, Flash Player 11.2.202.457-158.1.

How urgently should CVE-2015-3042 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

WatchlistCritical

CVE-2015-3042Flash Player Vulnerability

flash-plugin: multiple code execution issues fixed in APSB15-06

Published Apr 14, 2015 · Updated Feb 4, 2026 · Also known as UBUNTU-CVE-2015-3042

Key Facts

Patch immediately

CVE-2015-3042 is a critical-severity vulnerability (CVSS 10.0 v2) affecting Flash Player (Adobe), Opensuse, Enterprise Linux Desktop Supplementary (Redhat) and 9 more products.
It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
EPSS estimates a 37% probability of exploitation in the next 30 days.
Fixed versions are available, including Flash Player 11.2.202.451, Flash Player 11.2.202.418-0.3.1, Flash Player 11.2.202.457-158.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v2

10.0

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS (30-day exploit likelihood)

37%

Higher than 98.4% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

46/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

advisoryhttps://ubuntu.com/security/CVE-2015-3042
advisoryhttps://www.cve.org/CVERecord?id=CVE-2015-3042
advisoryopenSUSE-SU-2015:0718
advisorySUSE-SU-2015:0722
advisorySUSE-SU-2015:0723
advisoryRHSA-2015:0813

Description

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3043.

Affected Products

45 affected entries in total

Product	Affected versions	Fixed in
Flash PlayerAdobe	14.0.0.125, 14.0.0.145, 14.0.0.176, 14.0.0.179, 15.0.0.152, 15.0.0.167, 15.0.0.189, 15.0.0.223	11.2.202.451
OpensuseOpensuse	13.1, 13.2	n/a
Enterprise Linux Desktop SupplementaryRedhat	5.0, 6.0	n/a
Enterprise Linux Server SupplementaryRedhat	5.0, 6.0	n/a
Enterprise Linux Server Supplementary EusRedhat	6.6.z	n/a

7 more affected products in the full CVE brief

Patched Releases

Flash Player

11.2.202.451, 11.2.202.418-0.3.1, 11.2.202.457-158.1, 11.2.202.457-2.48.1, 11.2.202.457-80.1

flash-player-gnome

11.2.202.418-0.3.1, 11.2.202.457-158.1, 11.2.202.457-2.48.1, 11.2.202.457-80.1

flash-player-kde4

11.2.202.418-0.3.1, 11.2.202.457-158.1, 11.2.202.457-2.48.1

flash-plugin

0:11.2.202.457-1.el5, 0:11.2.202.457-1.el6_6

flashplugin-nonfree

11.2.202.457ubuntu0.14.04.1

Timeline

Publicly disclosed
Apr 14, 2015
Last updated
Feb 4, 2026

References

15 more references in the full CVE brief

FAQ

Common Questions.

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-03…
Affected: Flash Player (Adobe) versions 14.0.0.125, 14.0.0.145, 14.0.0.176, 14.0.0.179, 15.0.0.152, 15.0.0.167, 15.0.0.189, 15.0.0.223; Opensuse versions 13.1, 13.2; Enterprise Linux Desktop Supplementary (Redhat) versions 5.0, 6.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Flash Player 11.2.202.451, Flash Player 11.2.202.418-0.3.1, Flash Player 11.2.202.457-158.1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2015-3042 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.