CVE-2015-5555

Vulnerability

Adobe Flash Player before 18.0.0.232 on Windows and OS X, before 11.2.202.508 on Linux, and Adobe AIR before 18.0.0.199 (including SDK and SDK & Compiler) contain an unspecified type confusion vulnerability [1][2]. This vulnerability can be triggered via a crafted SWF file or other means, leading to memory corruption.

Exploitation

An attacker can exploit this vulnerability by delivering a malicious Flash file (SWF) to a user, typically via a web page or email. No authentication is required; the user must only open the malicious content in a vulnerable Flash Player or AIR runtime [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code within the context of the affected application, potentially leading to full system compromise. This could result in data disclosure, denial of service, or further privilege escalation [1][2].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux), and AIR 18.0.0.199 [2]. Users should update immediately. Red Hat also issued an update for affected packages [1]. No workaround is available; updating is the only mitigation [2].