CVE-2015-8058

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. The same flaw affects Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204. The bug is triggered via unspecified vectors and is distinct from many other Flash Player vulnerabilities disclosed in the same update [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted Flash SWF file, typically delivered through a compromised website, email attachment, or malicious advertisement. No additional authentication or user interaction beyond opening the content is required. The exploit involves corrupting memory to achieve code execution within the context of the user running Flash Player [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the affected system. This can lead to full compromise of the user's session, installation of malware, data exfiltration, or other malicious actions with the privileges of the victim [1].

Mitigation

Adobe released updated versions: Flash Player desktop 20.0.0.228 (Windows/Mac), Flash Player extended support release 18.0.0.268, Linux Flash Player 11.2.202.554, and AIR 20.0.0.204 on the same day as disclosure. Users should update immediately. Gentoo Linux users can emerge >=www-plugins/adobe-flash-11.2.202.559 [1]. No workaround was available at the time of disclosure.