CVE-2015-8068

Vulnerability

The vulnerability is a use-after-free bug in Adobe Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 [1]. The issue can be triggered via unspecified vectors, likely by loading a specially crafted SWF file or content that causes improper memory handling.

Exploitation

An attacker can exploit this vulnerability by convincing a user to visit a webpage or open a file containing malicious Flash content [1]. No authentication or additional privileges are required; the attacker only needs to deliver the crafted SWF content to the victim, which can be achieved through a compromised website, malvertising, or email links.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected Flash Player process [1]. This can lead to full compromise of the user's system, including data theft, installation of malware, or further lateral movement within a network.

Mitigation

Adobe released patched versions on December 8, 2015: Flash Player 20.0.0.228, 18.0.0.268, and 11.2.202.554, along with updated AIR packages [1]. Users should upgrade immediately. For Linux, Gentoo recommends upgrading to www-plugins/adobe-flash-11.2.202.559 [1]. No workaround was available at the time [1]. This CVE is part of a larger batch of Flash vulnerabilities addressed in the same update.