CVE-2015-8430

Vulnerability

CVE-2015-8430 is a use-after-free vulnerability in Adobe Flash Player affecting versions before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, and related Adobe AIR versions before 20.0.0.204 [1]. The vulnerability resides in the TextField.text setter; when setting the text to an object with a custom toString method, the toString function can free the parent object of the text field, which is subsequently used, leading to the use-after-free condition [2].

Exploitation

An attacker can exploit this by delivering a crafted SWF file that triggers the use-after-free. The provided proof-of-concept demonstrates the attack: a createTextField call is made, and its .text property is set to a JavaScript object with a toString function. Inside that function, the parent movie clip (mc) is removed via removeMovieClip(), freeing the underlying object. After the function returns, the freed memory is accessed [2]. No user interaction beyond loading the SWF file is required; a remote attacker can host the malicious SWF or inject it into a web page. The exploit can be used to achieve arbitrary code execution [1].

Impact

Successful exploitation allows a remote attacker to execute arbitrary code with the privileges of the affected Flash Player process [1]. This can lead to full system compromise, including data disclosure, installation of malware, or further escalation of privileges. The vulnerability also can cause a denial of service or bypass security restrictions [1].

Mitigation

Adobe patched this vulnerability with the release of Flash Player 20.0.0.228 (and corresponding versions for other platforms) in December 2015 [1]. Users should upgrade to the latest version as indicated by the vendor. The Gentoo security advisory recommends upgrading to version 11.2.202.559 for Linux [1]. There is no known workaround for unpatched versions [1]. The vulnerability is not listed on the CISA KEV as of the publication date.