CVE-2015-7634

Vulnerability

Adobe Flash Player versions prior to 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, and before 11.2.202.535 on Linux, as well as Adobe AIR before 19.0.0.213 and Adobe AIR SDK & Compiler before 19.0.0.213, are affected by a memory corruption vulnerability [1][2][3]. The bug is triggered via unspecified vectors, likely involving a specially crafted SWF file [2].

Exploitation

An attacker can exploit this vulnerability by delivering a malicious SWF file to a victim and persuading the victim to view a web page containing that file [2]. No additional authentication or special network position beyond the ability to serve or inject the SWF content is required; the attack succeeds if the victim uses an affected Flash Player or AIR runtime [1][2][3].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the affected system with the privileges of the user running Flash Player, or to cause a denial of service (memory corruption) [1][2][3]. In the context of a web browser plugin, this can lead to full system compromise if the user has administrative rights [2].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.252 and 19.0.0.207 for Windows and OS X, Flash Player 11.2.202.535 for Linux, and AIR 19.0.0.213 [1][2][3]. Red Hat provided updated packages (flash-plugin to 11.2.202.548) as part of RHSA-2015-1893 and RHSA-2015-2024 [1][2]. Gentoo also advised upgrading to >=www-plugins/adobe-flash-11.2.202.548 [3]. Users should apply the latest version from Adobe or their OS vendor.