CVE-2015-7654

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's handling of the Sound object. By manipulating arguments passed to the attachSound method, an attacker can force a dangling pointer to be reused after it has been freed [3]. This affects Flash Player versions before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X, before 11.2.202.548 on Linux, and Adobe AIR before 19.0.0.241 [2].

Exploitation

An attacker must craft a malicious SWF file containing specially constructed attachSound arguments to trigger the use-after-free. User interaction is required, as the target must visit a malicious page or open a malicious file [3]. The specific flaw lies in the sequence of operations that cause the freed memory to be reaccessed, leading to code execution.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process (the Flash Player instance). This can lead to full compromise of the affected system, including data theft, installation of malware, or further privilege escalation [3].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.261, 19.0.0.245, and 11.2.202.548; Adobe AIR 19.0.0.241. Red Hat and Gentoo advisories recommend updating to the patched versions immediately [2][4]. No workaround is available; users must apply the update to mitigate this vulnerability.