CVE-2015-8428

Vulnerability

A use-after-free vulnerability exists in the TextField.htmlText setter of Adobe Flash Player. When the htmlText property is set to an object with a custom toString method, the toString function can free the parent object (e.g., by removing the movie clip), leading to use of freed memory. Affected versions include Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, and corresponding Adobe AIR versions before 20.0.0.204 [1][2].

Exploitation

An attacker can exploit this by crafting a malicious SWF file that triggers the use-after-free. The proof-of-concept demonstrates creating a text field, setting its htmlText to an object with a toString function that removes the parent movie clip, then returning HTML content. The attacker must deliver the SWF to a victim (e.g., via a web page or email). No authentication is required, and user interaction is minimal (opening the SWF). The exploit can be used to achieve arbitrary code execution [2].

Impact

Successful exploitation allows arbitrary code execution in the context of the user running Flash Player. This can lead to full system compromise, including data theft, installation of malware, or denial of service. The vulnerability is rated critical with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) [1].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228, 18.0.0.268, and 11.2.202.554 (Linux), and AIR 20.0.0.204. Users should update immediately. Gentoo recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559 [1]. No workaround is available. This CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date.