CVE-2015-8061

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as in Adobe AIR before 20.0.0.204 and related SDKs. The flaw can be triggered via unspecified vectors, likely involving crafted SWF content that leads to referencing freed memory [1].

Exploitation

An attacker would host a malicious SWF file or inject it into a compromised web page, luring the victim to load it in a vulnerable Flash Player instance. No additional authentication or local access is required — the exploit is conducted remotely through a web browser or other Flash-enabled application [1].

Impact

Successful exploitation allows arbitrary code execution in the context of the user running Flash Player. This gives the attacker the ability to install programs, view, change, or delete data, and create new accounts with full user rights, leading to a complete compromise of confidentiality, integrity, and availability [1].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.268 and 20.0.0.228 (Windows/OS X), 11.2.202.554 (Linux), and AIR 20.0.0.204. Gentoo advises upgrading to >=www-plugins/adobe-flash-11.2.202.559. No workaround is available if the software cannot be updated; users should apply patches as soon as possible [1].