CVE-2015-8420

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's TextField.sharpness setter. When the sharpness parameter is an object with a valueOf function that frees the parent TextField, the freed memory is subsequently used. This affects Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204 and corresponding SDK versions [1][2].

Exploitation

An attacker can exploit this by crafting a SWF file that sets tf.sharpness to an object whose valueOf method removes the TextField's parent movie clip, causing a use-after-free when the property is assigned. No authentication or special network position is required beyond hosting the malicious SWF or embedding it in a web page. The PoC triggers the vulnerability on the second call to valueOf [2].

Impact

Successful exploitation can lead to arbitrary code execution in the context of the user running the Flash Player. The attacker gains full control over the affected system, potentially leading to data exfiltration, malware installation, or further compromise [1][2].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (Windows/OS X) and 11.2.202.559 (Linux), AIR 20.0.0.204, and corresponding SDK updates. Users should upgrade to these versions or later. This vulnerability is not known to be in active exploitation as of publication [1].