CVE-2015-8434

Vulnerability

Use-after-free vulnerability in Adobe Flash Player's Sound.setTransform method. When a transform value is set to an object with a valueOf function, the transform can be freed before the values are set, leading to a use-after-free condition [1]. Affected versions: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, before 11.2.202.554 on Linux; Adobe AIR before 20.0.0.204, AIR SDK before 20.0.0.204, and AIR SDK & Compiler before 20.0.0.204 [description].

Exploitation

An attacker can exploit this by crafting a malicious SWF file that triggers the use-after-free. The PoC demonstrates creating a sound object, attaching a sound, and calling setTransform with an object that has a valueOf function. When valueOf is invoked, it removes the movie clip, freeing the transform object. The attacker can then overwrite freed memory to achieve code execution [1]. No authentication or special network position is required; the victim only needs to load the malicious SWF in a vulnerable Flash Player.

Impact

Successful exploitation allows arbitrary code execution in the context of the user running Flash Player. This can lead to full system compromise, including data theft, installation of malware, or denial of service [2]. The vulnerability is part of a large batch of Flash Player flaws patched in December 2015.

Mitigation

Adobe released updates: Flash Player 20.0.0.228 (Windows/OS X), 11.2.202.554 (Linux), AIR 20.0.0.204, etc. [description]. Users should update to these versions. Gentoo Linux recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559 [2]. No workaround is available; updating is the only mitigation.