CVE-2015-5130

Vulnerability

CVE-2015-5130 is a use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X, and before 11.2.202.508 on Linux, as well as Adobe AIR before 18.0.0.199 and related SDKs [1][3]. The bug occurs when setting the scrollRect attribute of a MovieClip in ActionScript 2 (AS2) with a custom Rectangle, causing the MovieClip to be freed while a reference remains on the stack [2].

Exploitation

An attacker can exploit this by crafting a malicious SWF file that triggers the use-after-free. No authentication is required; the user must only open the file or visit a web page hosting the SWF. The exploitation sequence involves setting the scrollRect to a custom rectangle and then creating a TextField at the same depth as the targeted MovieClip, which overwrites the freed memory and can lead to code execution [2].

Impact

Successful exploitation allows remote attackers to execute arbitrary code in the context of the Flash Player process, potentially leading to full system compromise [1][3].

Mitigation

Adobe has released patched versions: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux), and AIR 18.0.0.199. Red Hat and Gentoo have also released updated packages [1][3]. There is no known workaround; users should upgrade immediately.