CVE-2015-8067

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, as well as in Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204. The flaw is triggered via unspecified vectors, likely involving crafted SWF content [1].

Exploitation

An attacker can exploit this vulnerability by delivering a malicious SWF file to a victim, typically through a compromised website or email attachment. No authentication or user interaction beyond opening the file is required. The exact exploitation steps are not publicly detailed, but the use-after-free condition can be leveraged to corrupt memory [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected process. This can lead to full system compromise, including data theft, installation of malware, or denial of service [1].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (Windows/OS X), 18.0.0.268 (Windows/OS X), 11.2.202.554 (Linux), and AIR 20.0.0.204. Gentoo Linux recommends upgrading to 11.2.202.559 [1]. No workaround is available; users should apply the updates immediately.