CVE-2015-8432

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before version 18.0.0.268 and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux, and in Adobe AIR before 20.0.0.204, AIR SDK before 20.0.0.204, and AIR SDK & Compiler before 20.0.0.204 [1]. The flaw is triggered via unspecified vectors, indicating a memory corruption issue where an object is accessed after it has been freed, leading to potential attacker control of program flow.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious SWF file or content that, when processed by an affected Flash Player instance, triggers the use-after-free condition. No special authentication or local access is required; the attack can be delivered remotely through a web page or other means that loads the malicious Flash content [1]. The exploitation does not require user interaction beyond visiting the hostile page or opening the malicious file.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Flash Player. This can lead to full compromise of the affected system, including installation of programs, viewing, changing, or deleting data, and creating new accounts with full user rights [1]. The vulnerability is rated with a high CVSS score due to the potential for remote code execution.

Mitigation

Adobe has released patched versions: Flash Player 18.0.0.268 and 20.0.0.228 (and 11.2.202.554 on Linux) along with corresponding AIR updates [1]. Users should upgrade immediately. Gentoo Linux provides updated packages via >=www-plugins/adobe-flash-11.2.202.559. No workaround is known at this time [1]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.