CVE-2015-7635

Vulnerability

CVE-2015-7635 is a use-after-free vulnerability in Adobe Flash Player affecting versions before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, and before 11.2.202.535 on Linux. It also affects Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213. The specific code path and object type involved are not disclosed in available references [1][2].

Exploitation

An attacker can exploit this vulnerability by convincing a victim to visit a web page containing a specially crafted SWF file (e.g., via a malicious website or an ad network). No authentication or additional privileges are required; the victim merely needs to load the malicious SWF content in a browser with an affected Flash Player version. The exact attack vector is unspecified in the references [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the victim's system, potentially leading to full system compromise. The attacker gains the same privileges as the current user, which could include access to sensitive data, installation of malware, or further network propagation. The CVSS score is critical, and the vulnerability is part of a cluster of similar use-after-free issues fixed in the same update [1][2].

Mitigation

Adobe released fixed versions on October 13, 2015: Flash Player 18.0.0.252 and 19.0.0.207 for Windows/OS X, and 11.2.202.535 for Linux; AIR 19.0.0.213 for all affected platforms. Red Hat released updated packages (flash-plugin 11.2.202.548) as part of RHSA-2015:2024 [2]. Users should update to the latest versions. If patching is not immediately possible, disabling or restricting Flash Player usage in the browser (e.g., via click-to-play settings) is a recommended workaround.