CVE-2015-3106

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's ActionScript 2 TextField.filters array property [2]. The flaw affects Flash Player versions before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X, and before 11.2.202.466 on Linux. It also impacts Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, as well as the AIR SDK and AIR SDK & Compiler on those platforms [1][3]. The vulnerability is triggered when the filters array is read while being modified, leading to a use-after-free condition [2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious SWF file that, when opened by a victim, triggers the use-after-free. The exploit works by setting the TextField.filters array, which causes Flash to create an internal array. When the property is read, Flash iterates over this array and clones each filter. During this loop, the attacker can override a filter's constructor to execute arbitrary ActionScript 2 code. If that code alters the filters array, Flash frees the internal array, leaving a dangling pointer on the stack. When execution resumes, the freed memory is accessed, resulting in a use-after-free [2]. No authentication is required; the attacker only needs to convince the user to load the malicious SWF, typically via a web page or email attachment.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected Flash Player or AIR runtime [1][3]. This can lead to full system compromise, including data theft, installation of malware, or further lateral movement within a network. The vulnerability is rated as critical with a CVSS score of 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C) [1].

Mitigation

Adobe released fixed versions on June 9, 2015: Flash Player 18.0.0.160 (and 13.0.0.292 for older branches), AIR 18.0.0.144 on Windows and 18.0.0.143 on OS X and Android, and corresponding updates for the AIR SDK and AIR SDK & Compiler [1][3]. Red Hat issued RHSA-2015:1086 for affected Linux distributions [1], and Gentoo published GLSA 201506-01 [3]. No workaround is available; users must update to the patched versions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of this writing.