CVE-2015-3093

Vulnerability

A memory corruption vulnerability exists in Adobe Flash Player versions before 13.0.0.289 and 14.x through 17.x before 17.0.0.188 on Windows and OS X, and before 11.2.202.460 on Linux, as well as in Adobe AIR before 17.0.0.172. The flaw resides in the handling of DefineBitsLossless and DefineBitsLossless2 tags [2]. When processing malformed compressed bitmap data, the zlib decompression routine may fail, but the return value is not properly checked, leaving an allocated buffer uninitialized. This memory can later be used in rendering [2].

Exploitation

An attacker does not require any special network position beyond the ability to deliver a crafted SWF file to the target, typically via a web page or email. The victim must open the malicious SWF in a vulnerable Flash Player instance. The attacker crafts a SWF containing a corrupted DefineBitsLossless or DefineBitsLossless2 tag, causing the player to use uninitialized heap memory [2]. The attacker can control the pattern of uninitialized data to achieve memory corruption [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code within the context of the Flash Player process, leading to potential full compromise of the affected system. Alternatively, a denial of service via crash can be achieved [1][3]. The vulnerability can also lead to information disclosure as uninitialized memory may contain sensitive data [2].

Mitigation

Adobe released fixed versions: Flash Player 17.0.0.188 (Windows/OS X) and 11.2.202.460 (Linux), and AIR 17.0.0.172 [1]. Red Hat issued RHSA-2015:1005 for affected Linux distributions [1]. Gentoo users should update to >=www-plugins/adobe-flash-11.2.202.460 [3]. No workaround is available, and systems that cannot be patched should consider removing or disabling Flash Player [3].