CVE-2015-8066

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player, Adobe AIR, and the AIR SDK & Compiler. The flaw is present in Flash Player versions before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux; in Adobe AIR before 20.0.0.204; and in AIR SDK & Compiler before 20.0.0.204. The vulnerability can be triggered via unspecified vectors, which likely involve crafted SWF content that frees a memory object without nullifying its references.

Exploitation

An attacker can exploit this vulnerability by tricking a user into opening a malicious Flash file delivered through a web page, email, or other media. No authentication is required; the attacker only needs to serve the crafted content to a victim using an unpatched version. The attack sequence involves setting up memory to create a use-after-free condition, then executing arbitrary code.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user. This can lead to full compromise of the affected system, including data theft, installation of malware, or further lateral movement within a network. The impact is rated as critical, with a CVSS score indicating high severity for confidentiality, integrity, and availability.

Mitigation

Adobe released fixes on December 8, 2015, updating Flash Player to 20.0.0.228 (Windows/OS X) and 11.2.202.554 (Linux), AIR to 20.0.0.204, and corresponding SDK versions. Users should upgrade immediately from the official Adobe downloads. Gentoo Linux users can update via emerge --sync && emerge --ask --oneshot --verbose ">=www-plugins/adobe-flash-11.2.202.559" [1]. There is no known workaround; applying the patch is essential.