CVE-2015-8063

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player prior to version 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. The flaw also affects Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204. The vulnerability can be triggered through unspecified vectors, likely involving specially crafted SWF content [1].

Exploitation

An attacker would typically host a malicious SWF file on a website or inject it into a compromised ad network. No authentication or special privileges are required; the victim simply needs to visit the attacker-controlled page using an affected Flash Player version. The exploitation leads to a use-after-free condition in the Flash Player memory management [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Flash Player. This could lead to full system compromise, including installation of malware, data theft, or creation of new user accounts with full privileges [1].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (for Windows/OS X), Flash Player 18.0.0.268 (for earlier branches), and Flash Player 11.2.202.559 (for Linux). Gentoo users should update to >=www-plugins/adobe-flash-11.2.202.559 [1]. There is no known workaround apart from updating or disabling Flash Player entirely.