CVE-2015-5541

Vulnerability

A heap-based buffer overflow vulnerability exists in Adobe Flash Player before 18.0.0.232 on Windows and OS X, before 11.2.202.508 on Linux, and in Adobe AIR before 18.0.0.199 (including SDK and SDK & Compiler). The flaw can be triggered through unspecified vectors, allowing an attacker to corrupt memory and potentially execute arbitrary code. This is distinct from CVE-2015-5129 [1][2].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted Flash file (SWF) or visit a web page containing malicious Flash content. No authentication is required, and the attack can be delivered remotely via a browser or any application that embeds Flash Player. The user interaction is limited to simply viewing or interacting with the malicious content [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected process. This can lead to full system compromise, including installation of programs, viewing, changing, or deleting data, or creating new accounts with full user rights. The impact is rated as critical with a CVSS score not fully specified but typically 9.3 or higher for such Flash vulnerabilities [1][2].

Mitigation

Adobe has released fixed versions: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux); AIR 18.0.0.199. Users should update immediately. Red Hat and Gentoo have shipped updates for their distributions. There is no known workaround; disabling Flash Player is the only alternative [1][2].