CVE-2015-5563

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.232 on Windows and OS X, before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199. The bug is reachable through unspecified vectors, and is one of several related issues including CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5561, CVE-2015-5564, and CVE-2015-5565 [1][2].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted SWF file or visit a malicious web page hosting the file. No additional authentication or privileges are required beyond web browser access to Flash content. The exact sequence of steps involves triggering the use-after-free condition via unspecified vectors [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code within the context of the affected Flash Player process. This can lead to full system compromise, including data disclosure, modification, or denial of service [1][2].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux), AIR 18.0.0.199, and corresponding SDK versions. Red Hat and Gentoo have issued updated packages [1][2]. No workaround is known; update to the patched version immediately.