CVE-2015-8410

Vulnerability

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, AIR SDK before 20.0.0.204, and AIR SDK & Compiler before 20.0.0.204. The bug resides in the MovieClip.attachBitmap method: if the depth parameter is an object with a valueOf property, the method can free the MovieClip object, which is then used afterwards [2].

Exploitation

An attacker can exploit this by crafting a malicious SWF file that calls attachBitmap with a depth object that has a valueOf function. When valueOf is invoked, the function removes the MovieClip (e.g., via removeMovieClip()), freeing the object. After the valueOf returns, the freed memory is accessed, leading to a use-after-free condition. The attacker can control the heap layout to achieve arbitrary code execution. No authentication or user interaction beyond opening the SWF is required [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the Flash Player. This can lead to full system compromise, including data theft, installation of malware, or denial of service [1][2].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (Windows/OS X), 11.2.202.554 (Linux), and AIR 20.0.0.204. Users should update immediately. Gentoo Linux recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559 [1]. No workaround is available [1]. This vulnerability is not listed on CISA's KEV.