CVE-2015-8062

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and macOS, and before 11.2.202.554 on Linux, as well as in Adobe AIR before 20.0.0.204 and related SDKs. The bug occurs when handling certain SWF content, leading to unsafe memory operations. The exact code path is not disclosed but is triggered by unspecified vectors [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a maliciously crafted SWF file, typically via a web page, email, or embedded content. No special authentication or network position is required beyond the ability to serve the crafted file to the victim. The exploit triggers a use-after-free condition in the Flash Player process [1].

Impact

Successful exploitation allows remote attackers to execute arbitrary code in the context of the user running the Flash Player. This can lead to full compromise of the affected system, including data theft, installation of malware, or further privilege escalation. The vulnerability is one of many in the same update batch, all leading to arbitrary code execution [1].

Mitigation

Adobe released official updates: Flash Player 20.0.0.228 (and 11.2.202.554 on Linux), AIR 20.0.0.204, and corresponding SDK versions on 2015-12-08. Users should upgrade immediately. There is no known workaround. Gentoo Linux provides updated packages as part of GLSA 201601-03 [1]. This CVE is not listed on CISA's KEV.