CVE-2015-8402

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. It also affects Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204. The flaw is triggered via unspecified vectors, indicating a memory corruption issue where an object is accessed after it has been freed [1].

Exploitation

An attacker can exploit this vulnerability by delivering a crafted SWF file to a victim, typically via a malicious webpage or an email attachment. No special authentication or network position is required beyond the ability to serve content that the victim's Flash Player processes. The exact sequence of steps involves triggering the use-after-free condition through the unspecified vectors, leading to memory corruption that can be leveraged for arbitrary code execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Flash Player. This can lead to full system compromise, including data theft, installation of malware, or further lateral movement within a network. The vulnerability is classified as critical with a CVSS base score of 9.3 (AV:N/AC:M/Au:N/C:C/I:C/A:C).

Mitigation

Adobe released fixed versions on 2015-12-08: Flash Player 20.0.0.228, 18.0.0.268 (and 11.2.202.554 for Linux), AIR 20.0.0.204, AIR SDK 20.0.0.204, and AIR SDK & Compiler 20.0.0.204. Users should upgrade immediately. The Gentoo GLSA recommends upgrading to www-plugins/adobe-flash-11.2.202.559 (or later) [1]. No workaround exists; the only mitigation is to apply the patch or disable Flash Player entirely.