CVE-2015-7652

Vulnerability

A use-after-free vulnerability exists in the TextField.gridFitType property setter of Adobe Flash Player. The bug resides in the ActionScript 2 TextField object; when gridFitType is set to an object whose toString method frees the TextField, the dangling pointer is subsequently reused. This affects Flash Player before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X, before 11.2.202.548 on Linux, and Adobe AIR before 19.0.0.241 [1][2][3]. A proof-of-concept ActionScript 2 snippet shows var o = {toString : func} where func calls removeMovieClip() to free the text field during the property assignment [4].

Exploitation

An attacker must craft a malicious SWF file that triggers the use-after-free. The exploit requires user interaction: the victim must open a malicious page or file hosting the SWF. No special network position is needed beyond standard web delivery. The specific flaw leverages the gridFitType property setter: when gridFitType is assigned an object with a custom toString method, that method can free the TextField object; after the method returns, the setter writes to the freed memory [3][4]. A successful exploit follows the sequence of creating a TextField, assigning an object with a malicious toString to gridFitType, and letting the playback engine execute the freed memory.

Impact

Successful exploitation allows remote code execution in the context of the current process (the Flash Player plugin or standalone player). The attacker gains the ability to execute arbitrary code, potentially leading to full compromise of the affected system [2][3]. The vulnerability is rated Critical (CVSS base score 6.8 [3]) and can lead to information disclosure, file write, or installation of malware.

Mitigation

Adobe released fixed versions: Flash Player 19.0.0.245 (and 18.0.0.261 for earlier 18.x), Linux 11.2.202.548, and Adobe AIR 19.0.0.241. Red Hat issued updated flash-plugin packages (version 11.2.202.548) for Red Hat Enterprise Linux 5 Supplementary [2]. Users should update to the patched versions immediately. No workaround exists; disabling Flash Player in the browser reduces exposure.