CVE-2015-8055

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before versions 18.0.0.268 and 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as in Adobe AIR before 20.0.0.204 and related SDKs. The flaw affects the processing of specially crafted SWF files, leading to memory corruption. The exact code path requires the user to load a malicious Flash content, which can be delivered through a web page or other means.

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a malicious SWF file, typically via a web browser or an application that renders Flash content. No authentication is required, and the attacker does not need prior access to the target system. The attack can be initiated remotely by hosting the malicious content on a website or embedding it in a document.

Impact

Successful exploitation allows the attacker to execute arbitrary code with the privileges of the affected user. This could lead to full system compromise, including potential denial of service, information disclosure, or bypass of security restrictions [1]. The vulnerability can be chained with other issues to achieve greater impact.

Mitigation

Adobe released patched versions: Flash Player 20.0.0.228 (Windows/OS X) or Flash Player 18.0.0.268 (for those on older channels), and Flash Player 11.2.202.554 (Linux). Adobe AIR was fixed in version 20.0.0.204. The Gentoo Linux advisory [1] recommends upgrading to version 11.2.202.559. No workarounds are available. Given that Flash Player is end-of-life, users should strongly consider removing the software entirely.