CVE-2015-5134

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions before 18.0.0.232 on Windows and OS X, before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199. The flaw occurs when a native AS2 class sets an internal variable that is a SharedObject, leading to a use-after-free condition. This affects variables such as NetConnection.contentType and certain properties of the Sound and NetStream classes [2].

Exploitation

An attacker can trigger the use-after-free by loading a specially crafted SWF file that manipulates AS2 class variables and forces garbage collection. The provided proof-of-concept requires hosting two SWF files (loadswf.swf and donotdelete.swf) on a webserver to work reliably, as local file access may be restricted by Flash network sandboxing. The exploit described is specifically for 64-bit systems, but the vulnerability is also present on 32-bit systems with proper heap setup [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running Flash Player. This can lead to full system compromise, including installation of malware, data theft, or further network propagation [1][3].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.232 (Windows/OS X), 11.2.202.508 (Linux), and AIR 18.0.0.199 [1][3]. Red Hat and Gentoo have issued advisories urging immediate update [1][3]. Users should apply updates as soon as possible; no workaround is available.