CVE-2015-8065

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. Adobe AIR, AIR SDK, and AIR SDK & Compiler versions before 20.0.0.204 are also affected. The flaw is triggered via unspecified vectors, likely involving crafted SWF content [1].

Exploitation

An attacker can exploit this vulnerability remotely by convincing a user to open a malicious Flash file or visit a compromised web page. No authentication is required, and the attack can be delivered through web browsers, email attachments, or other means that load Flash content. The exact exploitation steps are not publicly detailed, but the vulnerability is known to be exploitable for arbitrary code execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected process. This could lead to full system compromise, including installation of malware, data theft, or denial of service. The vulnerability may also be used to bypass security restrictions or obtain sensitive information [1].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.268, 20.0.0.228, and 11.2.202.554; AIR 20.0.0.204. The Gentoo security advisory recommends upgrading to www-plugins/adobe-flash-11.2.202.559 [1]. No workaround is available; users should apply the update immediately.