CVE-2015-8429

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player's TextField.type setter, affecting versions before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204 and related SDKs [2]. When the type property is set to an object with a custom toString method, the toString function can remove the parent movie clip, freeing the TextField object, which is then still used after the free [2].

Exploitation

An attacker can trigger the vulnerability by persuading a user to open a specially crafted SWF file [2]. The proof-of-concept involves creating a movie clip and a text field, then setting the type property to an object with toString defined. The toString function calls removeMovieClip() on the parent, freeing the text field, after which the TextField.type setter continues to use the freed memory [2]. Exploitation requires no authentication beyond user interaction to load the SWF.

Impact

Successful exploitation allows arbitrary code execution in the context of the user running the Flash Player [1]. An attacker could execute arbitrary commands, potentially leading to full system compromise, including information disclosure, installation of malware, or denial of service [1].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (Windows/OS X), 11.2.202.559 (Linux), and AIR 20.0.0.204 [1][2]. Users should update to the latest versions. The Gentoo GLSA recommends upgrading to www-plugins/adobe-flash-11.2.202.559 [1]. No workaround is available [1]. This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of this writing.