CVE-2015-5562

Vulnerability

Adobe Flash Player before 18.0.0.232 on Windows and OS X, before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 contain an unspecified type confusion vulnerability [1]. This allows attackers to execute arbitrary code. The issue is distinct from CVE-2015-5554, CVE-2015-5555, and CVE-2015-5558. The affected versions include all those prior to the specified patched versions.

Exploitation

An attacker can exploit this vulnerability by delivering a specially crafted SWF file to a user. No authentication or specific user privileges are required beyond the user opening the malformed file in a vulnerable Flash Player instance. The vulnerability can be triggered remotely via a web page or other means of delivering the malicious SWF content [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the Flash Player process [1][2]. This could lead to full compromise of the affected system, including data theft, installation of malware, or further lateral movement within a network.

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux), and AIR 18.0.0.199. Red Hat issued RHSA-2015:1603 for affected RHEL packages [1]. Gentoo recommends upgrading to >=www-plugins/adobe-flash-11.2.202.508 [2]. Users should apply the appropriate updates as soon as possible.