CVE-2015-0311

What Is Adobe Flash Player?

Adobe Flash Player was a ubiquitous browser plugin for interactive multimedia, installed on over 90% of internet-connected computers at its peak. Its cross-platform reach made every Flash vulnerability a potential attack vector against virtually any operating system. Adobe ended Flash Player support December 31, 2020.

See related Flash vulnerabilities from this campaign: CVE-2015-0310 (ASLR bypass paired with this RCE), CVE-2015-0313 (next major Flash zero-day, February 2015).

Overview

CVE-2015-0311 is a critical remote code execution zero-day in Adobe Flash Player that was actively exploited by the Angler exploit kit in large-scale malvertising campaigns before Adobe released a patch. Users visiting web pages or viewing ads containing malicious Flash content were silently compromised without any interaction. Adobe released an out-of-band patch APSB15-03 on January 27, 2015 — five days after the zero-day was discovered in active exploitation. The CVSS 9.8 reflects its network accessibility, no authentication required, and no user interaction (the malicious SWF auto-executes in Flash Player).

Affected Versions

Technical Details

Root Cause: Memory Corruption in Flash Content Processing

CVE-2015-0311 involves a memory corruption vulnerability — likely a use-after-free, buffer overflow, or type confusion — in the way Flash Player processes certain SWF content. The exact vulnerability allows an attacker to achieve arbitrary code execution when a specially crafted SWF file is opened or rendered in Flash Player.

Zero-Day Exploitation Timeline

The exploitation window demonstrated the speed of modern exploit kit operations:

• January 21: Angler begins mass-deploying CVE-2015-0311 in malvertising campaigns
• January 22: Adobe patches a related ASLR bypass (CVE-2015-0310) in APSB15-02, but CVE-2015-0311 remains a zero-day
• January 23: Security researchers (including Kafeine) identify and publish details of the zero-day exploitation in the wild
• January 27: Adobe issues out-of-band APSB15-03 — unusually fast turnaround for a critical Flash zero-day

Pairing With CVE-2015-0310

In Angler's January 2015 campaign, CVE-2015-0311 was paired with CVE-2015-0310 (ASLR bypass):

1. The malicious SWF first triggers CVE-2015-0310 to learn the Flash process memory layout
2. With addresses known, CVE-2015-0311 builds a reliable ROP chain and achieves code execution
3. A payload (typically a downloader or backdoor) is delivered silently to the victim

Attack Characteristics

Discovery

Discovered during active exploitation analysis by security researcher Kafeine and others tracking Angler exploit kit campaigns in January 2015. The zero-day was in active use before Adobe was notified, leading to the rapid out-of-band patch cycle.

Exploitation Context

• Angler exploit kit zero-day: Angler was the most sophisticated commercial exploit kit of the era and uniquely known for incorporating Flash zero-days before patches were available — CVE-2015-0311 was exploited for 6 days before any patch existed
• Malvertising scale: The January 2015 Angler malvertising campaign used CVE-2015-0311 to deliver payloads to users of major websites through compromised advertising networks; estimates suggest hundreds of thousands of visitors were exposed per day
• No user interaction required: Unlike phishing attacks requiring clicks, the Flash auto-execution meant any user with Flash enabled visiting a page with the malicious ad was silently compromised
• Payload delivery: Angler's typical payloads in this campaign included ransomware and banking trojans
• CISA KEV (2022): Added April 2022

Remediation

1. Remove Flash Player — uninstall completely from all systems. Adobe's Flash uninstaller and Microsoft's KB4577586 (distributed via Windows Update) remove Flash from Windows systems.

2. Migrate Flash-dependent applications — any remaining Flash dependency is permanently unpatchable and a source of ongoing risk; migrate to HTML5.

3. Network isolation — systems that cannot remove Flash should be isolated from untrusted networks and internet access.

4. Browser controls — all modern browsers have removed Flash support. Legacy browsers with Flash enabled should be replaced with Edge or Chrome.