CVE-2015-8418

Vulnerability

CVE-2015-8418 is a memory corruption vulnerability in Adobe Flash Player affecting versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. It also affects Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204. The vulnerability is triggered via unspecified vectors, likely involving a crafted SWF file that causes memory corruption [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted SWF file or visit a malicious web page hosting the file. No authentication is required, and the attack can be delivered remotely over the network. The exact exploitation steps are not publicly detailed, but the memory corruption can be leveraged to execute arbitrary code [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running the Flash Player, or cause a denial of service (application crash). This could lead to full compromise of the affected system, including data theft, installation of malware, or disruption of services [1].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (Windows/OS X) and 11.2.202.559 (Linux), and AIR 20.0.0.204. Users should upgrade immediately. The Gentoo security advisory (GLSA 201601-03) recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559 and notes that no workaround is available [1].