CVE-2015-5552

Vulnerability

A memory corruption vulnerability exists in Adobe Flash Player and Adobe AIR. Affected versions are Flash Player before 18.0.0.232 on Windows and OS X, before 11.2.202.508 on Linux, and Adobe AIR before 18.0.0.199 (including SDK and SDK & Compiler). The vulnerability can be triggered via unspecified vectors, as described in the official advisory[1][2].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted Flash file or visit a malicious web page. No authentication or special privileges are required. The attack vector is remote, requiring user interaction (such as clicking a link or opening a file). The exact exploitation steps are not detailed in public references, but the vulnerability is classified as memory corruption, often leveraged for code execution.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, or cause a denial of service (memory corruption). This could lead to full compromise of the affected system's confidentiality, integrity, and availability, depending on the attacker's payload.

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.232 (Windows and OS X), 11.2.202.508 (Linux), and AIR 18.0.0.199. Users should update to these or newer versions. No workaround is known. Red Hat and Gentoo have issued advisories urging upgrades[1][2].