CVE-2015-8423

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's TextField.replaceSel method. When the string parameter is an object with a custom toString or valueOf method, the method can be triggered to delete the parent TextField or its container, leading to a use-after-free condition. This affects Flash Player versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as corresponding Adobe AIR versions [2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious SWF file that triggers the use-after-free. The attacker must convince the user to open the file or visit a web page hosting the SWF. Exploitation requires no authentication. The PoC demonstrates a sequence where replaceSel is called with an object whose valueOf method removes the parent movie clip, freeing the TextField. The subsequent use of the freed memory can be controlled by heap spraying to execute arbitrary code [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Flash Player [1]. This can lead to full compromise of the affected system, including installation of malware, data theft, or further propagation.

Mitigation

Adobe released fixes in Flash Player 20.0.0.228 (Windows/OS X), 11.2.202.554 (Linux), and AIR 20.0.0.204 in December 2015 [1]. Users should update immediately. There is no known workaround for this vulnerability. The CVE is not listed in the KEV catalog.