CVE-2015-8064

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.268 and 19.x/20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. The issue also affects Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204. The vulnerability can be triggered via unspecified vectors, leading to memory corruption [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted Flash file, typically delivered through a web page, email attachment, or other means. No authentication is required, and the attack can be performed remotely. The exact sequence of steps is not disclosed, but the use-after-free condition is triggered during Flash Player's processing of the malicious content.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running the affected Flash Player instance. This can lead to full system compromise, including data theft, installation of malware, or further lateral movement within a network.

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.268 and 20.0.0.228 for Windows and OS X, and 11.2.202.559 for Linux (as recommended by the Gentoo security advisory [1]). For AIR, upgrade to version 20.0.0.204. No workaround is available; users should apply the updates immediately.