CVE-2015-8401

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions prior to 18.0.0.268 and 19.x and 20.x prior to 20.0.0.228 on Windows and OS X, and prior to 11.2.202.554 on Linux. The issue also affects Adobe AIR before 20.0.0.204, AIR SDK before 20.0.0.204, and AIR SDK & Compiler before 20.0.0.204. The vulnerability is triggered via unspecified vectors, likely involving crafted SWF content that causes a dangling pointer reference after an object is freed [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a malicious Flash file or visit a web page hosting the crafted content. No authentication is required, and the attack can be delivered remotely. The exact exploitation steps are not publicly detailed, but the use-after-free condition can be leveraged to corrupt memory and achieve code execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected Flash Player process. This can lead to full compromise of the user's system, including data theft, installation of malware, or further lateral movement within a network [1].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.268 and 20.0.0.228 for Windows and OS X, 11.2.202.554 for Linux, and AIR 20.0.0.204. Users should update to these or later versions. The Gentoo Linux advisory recommends upgrading to >=11.2.202.559 [1]. No workaround is available; updating is the only mitigation.