CVE-2015-7636

Vulnerability

CVE-2015-7636 is a use-after-free vulnerability in Adobe Flash Player affecting versions before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, and before 11.2.202.535 on Linux, as well as Adobe AIR before 19.0.0.213 and related SDKs [1][2]. The flaw resides in the Flash Player runtime and can be triggered via unspecified vectors, likely involving a crafted SWF file that references freed memory [2].

Exploitation

An attacker would typically host a specially crafted SWF file on a website or inject it into a compromised web page. Then, the victim would need to load that page in a browser with a vulnerable Flash Player [2]. No special authentication or network position beyond delivering the malicious content is required. The exact sequence of steps is not disclosed, but the vulnerability is triggered by the Flash Player processing the crafted content, leading to a use-after-free condition [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected user's browser or application [2]. This could lead to full system compromise, including data theft, installation of malware, or further lateral movement. The impact severity is considered Critical, with CVSS scores indicating high risk [2].

Mitigation

Adobe released fixes for Flash Player version 18.0.0.252 and 19.0.0.207 on Windows and OS X, and version 11.2.202.535 on Linux, as well as updated AIR and SDK versions [1][2]. Red Hat provided updated packages for Enterprise Linux in RHSA-2015:1893 and RHSA-2015:2024, which upgrade Flash Player to version 11.2.202.548 [1][2]. Users should apply the latest updates as soon as possible. There are no known workarounds; disabling Flash Player or using a browser that blocks it can mitigate risk if patching is not immediate [2].