CVE-2015-5566

Vulnerability

CVE-2015-5566 is a use-after-free vulnerability in Adobe Flash Player. It affects versions before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux. Also affected are Adobe AIR, AIR SDK, and AIR SDK & Compiler before version 18.0.0.199. The vulnerability can be triggered via unspecified vectors, making it reachable through malicious Flash content delivered via web pages or email attachments.

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted Flash file, typically through a web browser or document reader that embeds Flash content. No authentication or prior access is required, as the attack can be delivered remotely. The use-after-free condition occurs during memory management operations, allowing the attacker to control program flow.

Impact

Successful exploitation allows an attacker to execute arbitrary code within the context of the user running Flash. This can lead to full system compromise, including installation of malware, data theft, or further network propagation. The CVSS base score is 9.3 (Critical), reflecting high impact on confidentiality, integrity, and availability.

Mitigation

Adobe released fixed versions as part of the August 2015 security update: Flash Player 18.0.0.232 (Windows/OS X) and 11.2.202.508 (Linux), and AIR 18.0.0.199 [1]. Users should update immediately through automatic update mechanisms or by downloading from Adobe's website. Red Hat provided updates for affected products via RHSA-2015:1603 [1]. Server-side actions such as disabling or removing Flash from browsers are effective workarounds for environments where Flash is not essential.