CVE-2015-8050

Vulnerability

A use-after-free vulnerability exists in the MovieClip object implementation of Adobe Flash Player. The flaw is triggered by a crafted call to the beginGradientFill method, which can cause a MovieClip-related object to be freed while still in use. This affects Flash Player versions before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 [1][2].

Exploitation

An attacker must convince a user to visit a malicious web page or open a crafted SWF file. No additional authentication or network position is required beyond serving the malicious content. By performing specific actions during the beginGradientFill call, the attacker can force the reuse of a freed object, leading to a use-after-free condition [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code within the context of the current process (typically the web browser or Flash Player plugin). This can lead to full compromise of the affected system, including data disclosure, modification, or denial of service [1][2].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (and 18.0.0.268 for older branches) on Windows and OS X, and 11.2.202.554 on Linux; AIR 20.0.0.204 for all AIR products. Users should update immediately. Gentoo Linux users should upgrade to >=www-plugins/adobe-flash-11.2.202.559 [2]. No workaround is available [2].