CVE-2015-5129

Vulnerability

Adobe Flash Player versions prior to 18.0.0.232 on Windows and OS X, and prior to 11.2.202.508 on Linux, along with Adobe AIR versions before 18.0.0.199, contain a heap-based buffer overflow vulnerability [1][2]. The flaw is triggered by unspecified vectors, likely involving malformed SWF content, and is distinct from CVE-2015-5541 [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a crafted Flash file (e.g., via a malicious web page or email attachment). No authentication or special network position is required, as the attack can be mounted remotely. The undefined nature of the vectors suggests a memory corruption path that is reachable without user interaction beyond loading the content [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected Flash Player or AIR process, potentially leading to full system compromise [1][2]. The vulnerability could also be used to cause a denial of service or bypass security restrictions [2].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux), and AIR 18.0.0.199 [1][2]. Red Hat and Gentoo have provided updated packages [1][2]. Users should upgrade immediately; there is no known workaround [2].