CVE-2015-8047

Vulnerability

Adobe Flash Player before 18.0.0.268 and 19.x/20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 are affected by a memory corruption vulnerability. The issue is triggered via unspecified vectors, allowing an attacker to corrupt memory in the Flash process.

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a malicious Flash file (e.g., via a web page or email attachment). No additional authentication or network position beyond the ability to deliver the crafted content is required. The exact exploitation steps are not disclosed in the available references, but the vulnerability is remotely exploitable.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected process or cause a denial of service (application crash). This can lead to full compromise of the user's system if the process runs with sufficient rights.

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.268, 20.0.0.228 (Windows/OS X), 11.2.202.554 (Linux), and AIR 20.0.0.204. The Gentoo security advisory [1] recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559. No workaround is available; users must apply the update.