CVE-2015-8427

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's TextField.variable setter. [2] When a variable name set to an object with a custom toString function, that function can free the parent object (e.g., by removing the movie clip), leading to use of freed memory. This affects Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, and Adobe AIR before 20.0.0.204.

Exploitation

An attacker can exploit this by convincing a user to open a specially crafted SWF file. The PoC demonstrates setting tf.variable to an object whose toString function calls mc.removeMovieClip(), freeing the text field's parent and causing a use-after-free when the variable assignment completes. [2] No special user interaction beyond opening the file is required.

Impact

Successful exploitation allows arbitrary code execution in the context of the user running Flash Player, potentially leading to full system compromise, including installation of malware or data theft.

Mitigation

Adobe released updates for Flash Player (18.0.0.268, 20.0.0.228, 11.2.202.554) and AIR (20.0.0.204). [1] Gentoo users should upgrade to >=www-plugins/adobe-flash-11.2.202.559. [1] No workaround is available. Users should apply the patches immediately.