CVE-2015-8431

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player when the TextField.tabIndex setter is invoked with an object having a custom valueOf method [2]. During the setter execution, the valueOf callback can remove the TextField's parent MovieClip, causing the TextField to be freed while it is still being accessed. This affects Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204 and related SDKs [1][2].

Exploitation

An attacker must deliver a crafted SWF file to the target, for example via a malicious website or email attachment. The SWF creates a TextField and sets its tabIndex to an object with a valueOf property defined as a function. When the setter triggers the valueOf callback, the function calls removeMovieClip() to delete the parent MovieClip, freeing the TextField object. Subsequent access to the freed memory can be leveraged to execute arbitrary code [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected Flash Player process. On modern browsers, this may lead to full compromise of the user's system, including data theft, installation of malware, or further network propagation [1][2].

Mitigation

Adobe released fixed versions in December 2015: Flash Player 20.0.0.228, 18.0.0.268 (Windows/OS X), and 11.2.202.559 (Linux); AIR 20.0.0.204 and corresponding SDKs [1]. Users should update to these or later versions immediately. Gentoo Linux provided an updated package via >=www-plugins/adobe-flash-11.2.202.559 [1]. No workaround is available; the only mitigation is to apply the vendor patch.