CVE-2015-8043

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions before 18.0.0.261 and 19.x before 19.0.0.245 on Windows and OS X, and before 11.2.202.548 on Linux, as well as in Adobe AIR before 19.0.0.241, Adobe AIR SDK before 19.0.0.241, and Adobe AIR SDK & Compiler before 19.0.0.241. The vulnerability is triggered via unspecified vectors, as reported in APSB15-25, APSB15-27, and APSB15-28 [1][2][3].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious SWF file and hosting it on a website or injecting it into a web page. No authentication or special network position is required; the victim simply needs to load the page containing the malicious SWF content in a browser with an affected Flash Player version.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the victim's system with the privileges of the user running the Flash Player instance. This can lead to full compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.261, 19.0.0.245 (Windows/OS X), 11.2.202.548 (Linux), and Adobe AIR 19.0.0.241. Red Hat provided updated flash-plugin packages (version 11.2.202.548) for Red Hat Enterprise Linux 5 Supplementary [1][2]. Gentoo users should upgrade to >=www-plugins/adobe-flash-11.2.202.548 [3]. No workarounds are available; users must update to patched versions.