CVE-2015-8413

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's Selection.SetSelection method. When SetSelection is called with a number parameter that is an object with a valueOf function, executing valueOf can free the parent TextField object via a removeMovieClip call. Subsequently, the freed object is used, leading to a use-after-free condition. Affected versions include Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, and Adobe AIR before 20.0.0.204 [1].

Exploitation

An attacker must deliver a specially crafted SWF file to the target, either by hosting it on a malicious website or via other means that trigger the user's Flash Player to load it. The PoC involves creating a text field, setting focus, then calling Selection.setSelection with an object that has valueOf defined. During the valueOf call, the parent movie clip is removed, freeing the text field object. After valueOf returns, the freed object is accessed, causing the use-after-free. This exploit currently works only on 64-bit platforms [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the vulnerable Flash Player process. This can lead to complete compromise of the affected system, including data theft, installation of malware, or further propagation [1][2].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228, 18.0.0.268, and 11.2.202.554 for Linux (later updated to 11.2.202.559 per Gentoo advisory), and AIR 20.0.0.204. Users should upgrade to these versions immediately. No known workarounds exist [2].