CVE-2015-8049

Vulnerability

A use-after-free vulnerability exists in the TextField object implementation of Adobe Flash Player [1]. The bug is triggered by manipulating the autoSize property of a TextField object, which causes a dangling pointer to be used after the object is freed [1]. Affected versions include Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux; Adobe AIR before 20.0.0.204, AIR SDK before 20.0.0.204, and AIR SDK & Compiler before 20.0.0.204 [2].

Exploitation

To exploit this vulnerability, an attacker must entice a user to visit a malicious web page or open a malicious file [1]. No additional authentication or write access is required beyond the user's interaction. The attacker supplies a crafted autoSize property value that triggers the use-after-free condition, leading to memory corruption that can be leveraged for arbitrary code execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process [1]. This can result in full compromise of the affected system, including the ability to install programs, view, change, or delete data, and create new accounts with full user rights. The CVSS score for this vulnerability is 6.8 (Medium) [1].

Mitigation

Adobe addressed this vulnerability by releasing updated versions of Flash Player, AIR, AIR SDK, and AIR SDK & Compiler [2]. The fixed versions are: Flash Player 20.0.0.228 (Windows and OS X), 18.0.0.268, and 11.2.202.559 (Linux); AIR 20.0.0.204; AIR SDK 20.0.0.204; and AIR SDK & Compiler 20.0.0.204 [2]. Users should upgrade to these patched versions immediately. No known workarounds are available [2].