CVE-2015-7640

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X, and before 11.2.202.535 on Linux. The flaw also affects Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 [1]. The bug is triggered via unspecified vectors, indicating a memory handling error where an object reference is not properly cleared after use, leading to a dangling pointer.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious SWF file that triggers the use-after-free condition. The victim must load a page containing this SWF content, typically through a web browser or any application embedding the vulnerable Flash Player [2]. No additional authentication or special network position is required; the attack can be performed remotely. The exploitation relies on the attacker controlling the content to induce the memory corruption.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the affected system, with the same privileges as the user running the Flash Player instance [1][2]. This can lead to full compromise of the user's session, including data theft, installation of malware, or further lateral movement within the network. The vulnerability is rated Critical by Red Hat [2] and is actively used in the wild.

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.252 and 19.0.0.207 for Windows/OS X, and 11.2.202.535 for Linux. Adobe AIR was updated to 19.0.0.213. Red Hat provided updated flash-plugin packages (version 11.2.202.548) as part of RHSA-2015:2024 [2]. Users should immediately update to the latest versions. No workaround is available; disabling Flash Player or using click-to-play plugins can reduce risk until patching is complete.