CVE-2015-8437

Vulnerability

A use-after-free vulnerability exists in the Selection object implementation of Adobe Flash Player. The flaw is triggered by calling the setFocus method, which can cause a use-after-free condition. Affected versions include Adobe Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 are also affected [1].

Exploitation

An attacker must convince a user to visit a malicious web page or open a malicious SWF file. No authentication is required. The specific flaw lies in the handling of Selection objects; by calling the setFocus method, a use-after-free can be triggered. An attacker can craft a SWF file to exploit this condition [1].

Impact

Successful exploitation allows arbitrary code execution in the context of the current process (the Flash Player plugin or standalone application). This can lead to full system compromise, depending on the privileges of the user running Flash [1][2].

Mitigation

Adobe released security updates on December 8, 2015, fixing the issue in Flash Player 20.0.0.228 (and corresponding versions for other branches). Gentoo Linux recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559 [2]. No workaround is available. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the last update.