CVE-2015-0313

What Is Adobe Flash Player?

Adobe Flash Player was the dominant cross-platform multimedia browser plugin from the late 1990s through the mid-2010s, installed on over 90% of internet-connected computers. Adobe ended Flash Player support December 31, 2020. January and February 2015 saw an unprecedented succession of Flash zero-days — three distinct zero-days (CVE-2015-0311, CVE-2015-0313, and CVE-2015-5119) were exploited before Adobe could patch them.

See related zero-days from this period: CVE-2015-0311 (January 2015 Angler zero-day), CVE-2015-5119 (July 2015 Hacking Team zero-day).

Overview

CVE-2015-0313 is a use-after-free zero-day in Adobe Flash Player exploited in active malvertising campaigns before Adobe released a patch. Documented by Trend Micro and researcher Kafeine as being deployed by the Hanjuan exploit kit (also called Nan Haishu) less than one week after the previous Flash zero-day (CVE-2015-0311) was patched. Adobe released an out-of-band patch APSB15-04 on February 5, 2015. The exploit required no user interaction — any user visiting a web page with the malicious Flash content was silently compromised.

Affected Versions

Technical Details

Root Cause: Use-After-Free in Flash Player

A use-after-free occurs when Flash Player frees a heap object but retains a pointer to the freed memory, later using that dangling pointer to access the object. If an attacker can control the heap allocation that occupies the freed memory region, the subsequent access reads attacker-controlled data — allowing virtual dispatch table (vtable) pointer replacement, function pointer corruption, or other control flow manipulation.

CVE-2015-0313 involves this class of vulnerability in Flash Player's ActionScript execution engine or object lifecycle management. When processing a specially crafted SWF file, Flash frees an internal object prematurely, then dereferences the stale pointer — at which point the attacker's heap spray has placed controlled data at that location, redirecting execution to attacker-controlled code.

Use-After-Free Exploitation Technique

Use-after-free in Flash Player was the dominant exploitation primitive in 2014–2015:

1. Trigger the free: Crafted ActionScript or SWF structure causes Flash to free a target object
2. Occupy the freed memory: Heap grooming / spraying places attacker-controlled data at the freed location
3. Trigger the use: Flash dereferences the stale pointer, now reading attacker-controlled vtable or function pointer
4. Code execution: Flash jumps to the attacker-controlled address, executing shellcode or a ROP chain

The Flash Zero-Day Succession

January–February 2015 demonstrated an accelerating cycle of Flash zero-day exploitation:

• CVE-2015-0311: Exploited by Angler, patched January 27 (APSB15-03)
• CVE-2015-0313: Exploited by Hanjuan only days later, patched February 5 (APSB15-04)

This pattern illustrated that multiple threat actors held independent Flash zero-days simultaneously — when Adobe patched one group's exploit, another group's remained active.

Attack Characteristics

Discovery

Discovered and publicly documented by Trend Micro researchers and Kafeine in early February 2015 during malvertising campaign analysis. The discovery came less than one week after the previous Flash zero-day (CVE-2015-0311) was patched, highlighting the speed at which new Flash zero-days entered active exploitation.

Exploitation Context

• Hanjuan exploit kit: A Chinese-nexus exploit kit that maintained Flash zero-days and targeted East Asian users; CVE-2015-0313 was observed in Hanjuan campaigns targeting users via compromised ad networks
• Malvertising delivery: Malicious ads containing the exploit SWF were served through legitimate advertising networks, exposing users of major legitimate websites
• Flash zero-day succession: CVE-2015-0313 was the second Flash zero-day in two weeks — the January–February 2015 period saw unprecedented Flash zero-day frequency, prompting security professionals to call for Flash's elimination
• Adobe's out-of-band response: Adobe's rapid 3-day patch turnaround (discovered February 2 → patched February 5) was atypically fast, reflecting recognition of the severity of ongoing mass exploitation
• Flash EOL legacy: Flash is permanently end-of-life since December 2020; any system still running Flash is permanently exposed to CVE-2015-0313 and all other Flash vulnerabilities
• CISA KEV (2022): Added April 2022

Remediation

1. Remove Flash Player — uninstall from all systems. Adobe's Flash uninstaller and Microsoft's KB4577586 (Windows Update) remove Flash from Windows.

2. Migrate Flash dependencies — any Flash-dependent application is permanently unpatched against this and all other known Flash vulnerabilities; migration to HTML5 is the only durable fix.

3. Network isolation — Flash-dependent systems that cannot be immediately decommissioned must be isolated from untrusted networks.

4. Browser controls — modern browsers have removed Flash support entirely; legacy browsers with Flash plugins should be replaced.