CVE-2015-5565

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player version 18.0.0.232 and earlier on Windows and OS X, version 11.2.202.508 and earlier on Linux, as well as Adobe AIR, AIR SDK, and AIR SDK & Compiler versions 18.0.0.199 and earlier. The flaw is triggered via unspecified vectors, allowing an attacker to corrupt memory after an object has been freed [1]. This vulnerability is distinct from other similar CVEs listed in the advisory.

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted Flash file, typically delivered through a web page or email. No additional authentication or privileges are required beyond the user accessing the malicious content. The exact method of exploitation is not publicly detailed, but it involves memory manipulation after the use-after-free condition is triggered.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the affected system. The attacker can gain the same privileges as the current user, potentially leading to full system compromise, including data theft, installation of malware, or further lateral movement within a network.

Mitigation

Adobe has released fixed versions: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux), and AIR 18.0.0.199 [1]. Users should update immediately. For systems where patching is not possible, consider disabling or uninstalling Flash Player, or using browser controls to block Flash content. Red Hat Enterprise Linux users can refer to RHSA-2015:1603 for updated packages.