CVE-2015-8060

Vulnerability

A memory corruption vulnerability exists in Adobe Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as in Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204. The flaw is triggered via unspecified vectors, likely involving crafted SWF content. This issue is distinct from other similar memory corruption vulnerabilities (CVE-2015-8045, CVE-2015-8047, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455) [1].

Exploitation

Exploitation requires an attacker to convince a user to visit a web page or open a file containing a malicious SWF file. No other privileged access or authentication is needed. The vulnerability can be triggered remotely through a browser or any application that uses the affected Flash Player or AIR runtime [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected process, or cause a denial of service (memory corruption). This can lead to full compromise of the user's system, unauthorized access to sensitive information, or disruption of service [1].

Mitigation

Adobe has released fixed versions: Flash Player 20.0.0.228 (and later), Flash Player 11.2.202.554 for Linux, AIR 20.0.0.204, AIR SDK 20.0.0.204, and AIR SDK & Compiler 20.0.0.204. Users should update to these or newer versions immediately. No known workaround exists for the vulnerability [1].