CVE-2015-8425

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions prior to 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR and AIR SDK versions before 20.0.0.204. The flaw occurs when a TextField's variable property is set to a string value, and the TextField is updated via a timer. If the assigned value is an object with a custom toString method, and that method frees the parent MovieClip containing the TextField, a use-after-free condition arises [1].

Exploitation

An attacker can exploit this by crafting a malicious SWF file that sets up a TextField with a variable, then uses setInterval to repeatedly update that variable with an object whose toString method removes the parent MovieClip. On the second update, the freed memory is accessed, leading to code execution. The PoC provided creates an empty MovieClip, adds a TextField, sets its variable to a string, then periodically replaces that string with an object that has a toString function that removes the parent MovieClip after the first call [1]. No user interaction beyond loading the SWF is required, and the attacker does not need prior authentication.

Impact

Successful exploitation allows arbitrary code execution in the context of the affected Flash Player instance. An attacker could potentially gain full control of the user's system, including the ability to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability is part of a large batch of Flash Player flaws disclosed in December 2015 [1][2].

Mitigation

Adobe released updates to address this vulnerability: Flash Player 20.0.0.228 (and 18.0.0.268 for older branches) for Windows and OS X, Flash Player 11.2.202.554 for Linux, and AIR 20.0.0.204. Gentoo Linux recommends upgrading to at least version 11.2.202.559 [2]. Users should update their Flash installations immediately. No workaround is known.