CVE-2015-5564

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions prior to 18.0.0.232 on Windows and OS X, and prior to 11.2.202.508 on Linux. It also affects Adobe AIR, AIR SDK, and AIR SDK & Compiler versions prior to 18.0.0.199. The vulnerability can be triggered via unspecified vectors, likely involving crafted Flash content [1][2].

Exploitation

An attacker can exploit this vulnerability by enticing a user to open a malicious SWF file or visit a compromised website hosting crafted Flash content. No authentication is required, and the attack can be performed remotely. The exact vector is not disclosed, but it is known to be exploitable through typical web-based attacks [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected user. This can lead to full system compromise, including data theft, installation of malware, or further propagation within a network [1][2].

Mitigation

Adobe has released updates to fix the vulnerability: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux), and Adobe AIR 18.0.0.199. Red Hat and Gentoo have also issued advisories urging immediate upgrades [1][2]. No workarounds are available; users should apply the latest updates promptly.