CVE-2015-8412

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's MovieClip.duplicateMovieClip method. When the depth or movie name parameter passed to this method is an object with custom toString or valueOf functions, the method can be made to free the MovieClip object and then later use it. This affects Adobe Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 [1][2].

Exploitation

An attacker can exploit this vulnerability by providing a crafted SWF file that triggers the use-after-free. Specifically, the attacker creates a MovieClip and calls duplicateMovieClip with an object parameter that overrides valueOf or toString. In the callback function, the attacker removes the original MovieClip (removeMovieClip), freeing the object. The Flash Player then continues to use the freed memory, leading to code execution. The attacker does not require any special network position beyond serving the SWF via a webpage or other means; user interaction (e.g., visiting a crafted page) is necessary. No authentication or write access is needed [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the Flash Player. This can result in full compromise of confidentiality, integrity, and availability (CIA), including remote code execution, information disclosure, denial of service, or bypass of security restrictions [1][2].

Mitigation

Adobe released fixed versions on December 8, 2015: Flash Player 20.0.0.228, 18.0.0.268, and 11.2.202.554 (Linux), and AIR 20.0.0.204. The Gentoo Linux GLSA 201601-03 recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559. No known workaround exists. The vulnerability is not listed on the CISA KEV as of the time of writing [1][2].