CVE-2015-8416

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's TextBlock object when the releaseLineCreationData method is called. This flaw allows an attacker to force a dangling pointer to be reused after it has been freed. Affected versions include Adobe Flash Player before 18.0.0.268 and 19.x through 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to visit a malicious web page or open a malicious file containing crafted SWF content. No authentication is required, and the attack can be launched remotely. The specific flaw is triggered by calling releaseLineCreationData on a TextBlock object, which leads to a use-after-free condition that can be leveraged for arbitrary code execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process (typically the web browser or Flash plugin). This can lead to full system compromise, including data theft, installation of malware, or denial of service. The CVSS score is 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) [1].

Mitigation

Adobe released fixes in Flash Player 20.0.0.228 (and corresponding updates for earlier branches) and AIR 20.0.0.204. Gentoo Linux users should upgrade to >=www-plugins/adobe-flash-11.2.202.559 [2]. No workaround is available. This CVE is not listed in the Known Exploited Vulnerabilities (KEV) catalog as of the publication date.