CVE-2015-8059

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions prior to 18.0.0.268, 19.x and 20.x prior to 20.0.0.228 on Windows and OS X, and prior to 11.2.202.554 on Linux. The issue also affects Adobe AIR, AIR SDK, and AIR SDK & Compiler before version 20.0.0.204. The vulnerability is triggered via unspecified vectors, likely involving crafted SWF content [1].

Exploitation

An attacker can exploit this vulnerability by delivering a malicious SWF file to a user, typically via a compromised website or through email. No authentication is required; the attacker relies on user interaction (visiting a page or opening a file) to trigger the use-after-free condition. Successful exploitation requires the user to open the malicious content in an affected Flash Player [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code within the context of the user running the Flash Player. This can lead to complete compromise of confidentiality, integrity, and availability, potentially allowing the attacker to install programs, view/change data, or create new accounts with full user rights [1].

Mitigation

Adobe has released security updates for Flash Player: version 20.0.0.228 for Windows and OS X, and version 11.2.202.554 for Linux. For AIR, version 20.0.0.204. Users should update to these patched versions or later. There is no known workaround [1]. Gentoo users should upgrade to >=www-plugins/adobe-flash-11.2.202.559 [1].