CVE-2015-8409

Vulnerability

Adobe Flash Player before version 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux; Adobe AIR before 20.0.0.204; Adobe AIR SDK before 20.0.0.204; and Adobe AIR SDK & Compiler before 20.0.0.204 contain an unspecified vulnerability that allows attackers to bypass intended access restrictions [1]. The exact mechanism is not detailed in available references, but it affects all listed versions.

Exploitation

An attacker can exploit this vulnerability by delivering a crafted SWF file to a user [1]. No authentication or special network position is required beyond the ability to serve the malicious file, typically via a web page or email. User interaction is required (e.g., opening the content in a browser or AIR application).

Impact

Successful exploitation might allow an attacker to bypass security restrictions, leading to arbitrary code execution in the context of the affected process, denial of service, or disclosure of sensitive information [1]. The full impact is not further specified in the available references.

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (Windows/OS X) and 11.2.202.559 (Linux), AIR/SDK 20.0.0.204 [1]. Gentoo Linux recommends upgrading to www-plugins/adobe-flash-11.2.202.559 or later [1]. No workaround is known [1]. A previous version (18.0.0.268 for Windows/OS X) may also be vulnerable; check vendor guidance.