CVE-2015-8417

Vulnerability

Adobe Flash Player versions before 18.0.0.268 on Windows and OS X, 19.x and 20.x before 20.0.0.228, and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204, are affected by a memory corruption vulnerability. The issue is triggered via unspecified vectors, likely through crafted SWF content. This vulnerability is distinct from several other Flash Player CVEs disclosed at the same time [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a malicious Flash file, typically delivered via a web page or email attachment. No authentication is required, and the attacker only needs to craft a specially designed SWF file that triggers memory corruption when processed by the vulnerable Flash Player. The exact exploitation steps are not publicly detailed, but the vulnerability is remotely exploitable [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Flash Player, or cause a denial of service (application crash). This could lead to full compromise of the affected system, including data theft, installation of malware, or further network attacks. The vulnerability may also enable information disclosure or security bypass [1].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (Windows/OS X), 11.2.202.554 (Linux), and AIR 20.0.0.204. Users should update immediately. The Gentoo advisory recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559 for Linux. No workaround is available [1].