CVE-2015-3113

What Is Adobe Flash Player?

Adobe Flash Player was the ubiquitous cross-platform multimedia browser plugin, installed on over 90% of internet-connected computers at peak deployment. Flash's universal presence made every Flash vulnerability a potential attack vector against virtually any Windows, macOS, or Linux system with a browser. Adobe ended Flash Player support December 31, 2020.

2015 was the worst year for Flash zero-days: CVE-2015-0311 (January), CVE-2015-0313 (February), CVE-2015-3043 (April), CVE-2015-3113 (June), CVE-2015-5119 (July), CVE-2015-5122 (July), CVE-2015-7645 (October), and CVE-2015-8651 (December) were all exploited as zero-days before Adobe released patches.

Overview

CVE-2015-3113 is a critical heap-based buffer overflow zero-day in Adobe Flash Player exploited by the Chinese-nexus threat actor APT3 (also tracked as UPS, Gothic Panda) in targeted spear-phishing campaigns against aerospace, defense, and telecommunications companies — an operation FireEye named "Operation Clandestine Wolf." Adobe released an emergency out-of-band patch APSB15-11 on June 23, 2015, approximately five days after active exploitation was detected. The vulnerability was simultaneously integrated into commercial exploit kits, exposing non-targeted users to drive-by attacks.

Affected Versions

Technical Details

Root Cause: Heap Buffer Overflow in Flash Media Handling

CVE-2015-3113 is a heap-based buffer overflow (CWE-787) in Adobe Flash Player's media processing or ActionScript runtime components. When Flash processes a specially crafted SWF file containing malformed media elements, the player writes data beyond the bounds of a heap-allocated buffer, corrupting adjacent heap memory in a way that enables control flow hijacking.

The exploitation pattern follows established Flash heap exploitation technique:

1. Heap grooming — shape the Flash heap with ActionScript allocations to control layout
2. Buffer overflow trigger — the crafted SWF causes Flash to write past the end of a heap buffer
3. Function pointer overwrite — adjacent heap memory containing a vtable or callback pointer is overwritten
4. ASLR/DEP bypass — typically combined with a separate information leak or heap spray for reliable address resolution
5. Code execution — Flash executes attacker-controlled shellcode or ROP chain

APT3 Spear-Phishing Delivery

APT3 delivered CVE-2015-3113 via spear-phishing emails containing links to attacker-controlled web pages hosting the malicious Flash content. The landing pages were tailored to target profiles — defense contractors and aerospace companies — and the exploit executed silently when targets visited the link.

Attack Characteristics

Discovery

FireEye discovered CVE-2015-3113 exploitation while investigating APT3 spear-phishing campaigns in June 2015. FireEye reported the vulnerability to Adobe on June 18, 2015, and Adobe released APSB15-11 five days later. FireEye published the Operation Clandestine Wolf report simultaneously with the patch.

Exploitation Context

• Operation Clandestine Wolf: APT3 used CVE-2015-3113 in a targeted campaign against U.S. defense, aerospace, and telecommunications companies — consistent with the group's strategic espionage mission focused on defense industrial base targets and technology theft
• Rapid exploit kit adoption: Within days of APSB15-11 publication, exploit kit operators integrated CVE-2015-3113 into Angler, Nuclear, and Magnitude kits for mass exploitation of unpatched users; the vulnerability's CVSS 9.8 and no-interaction requirement made it highly valuable
• 2015 Flash zero-day epidemic: CVE-2015-3113 was the fourth Flash zero-day of 2015, cementing Flash's status as the most dangerous browser plugin and intensifying calls from Google, Mozilla, and security researchers for browsers to block or disable Flash by default
• Flash EOL legacy: Flash is permanently end-of-life since December 2020; remaining Flash installations are permanently exposed to CVE-2015-3113 and all other known Flash vulnerabilities
• CISA KEV (2022): Added April 2022

Remediation

1. Remove Flash Player — uninstall from all systems. Adobe's Flash uninstaller and Microsoft's KB4577586 (Windows Update) remove Flash from Windows. Flash is permanently end-of-life with no further security updates.

2. Migrate Flash-dependent applications — identify remaining Flash content (internal apps, kiosks, ICS HMIs) and migrate to HTML5 or another supported technology.

3. Network isolation — Flash-dependent systems that cannot be decommissioned should be isolated from internet access and untrusted networks.

4. Browser controls — all modern browsers have removed Flash support. IE11 with Flash (if still present) should be upgraded to Edge or Chrome.