CVE-2015-7638

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before version 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, and before version 11.2.202.535 on Linux. The issue also affects Adobe AIR before version 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213. The vulnerability can be triggered via unspecified vectors, leading to memory corruption [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious SWF file and convincing a user to load it, typically through a web page or email attachment. No authentication is required, but user interaction is necessary to open the malicious content [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running the affected Flash Player instance. This can lead to full system compromise, including data theft, installation of malware, or further network propagation [1][2].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.252, 19.0.0.207, and 11.2.202.535 for Linux; AIR 19.0.0.213. Red Hat provided updated packages (flash-plugin 11.2.202.548) for Red Hat Enterprise Linux 5 Supplementary [2]. Users should apply the updates immediately. No workaround is available [1][2].