CVE-2015-8436

Vulnerability

A use-after-free vulnerability exists in the PrintJob object implementation of Adobe Flash Player. Versions before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux are affected, as well as Adobe AIR before 20.0.0.204. The flaw is triggered by manipulating the arguments passed to the addPage method, causing a dangling pointer to be reused after it has been freed [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to visit a malicious webpage or open a malicious file. No authentication is required, but user interaction is necessary. The specific flaw lies in the PrintJob.addPage method—by providing crafted arguments, the attacker can force a use-after-free condition. This can be leveraged to achieve arbitrary code execution [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process (likely the browser or a Flash hosting application). This can lead to full compromise of confidentiality, integrity, and availability of the affected system [1][2].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228, 18.0.0.268, and 11.2.202.554 for Linux, and Adobe AIR 20.0.0.204. Gentoo Linux users should upgrade to >=www-plugins/adobe-flash-11.2.202.559 [2]. No workaround is available for unpatched installations [2].