CVE-2015-8447

Vulnerability

A use-after-free vulnerability exists in the Color object implementation of Adobe Flash Player [1]. The flaw is triggered by manipulating arguments passed to the setTransform method of a Color object, causing a dangling pointer to be reused after it has been freed. Affected versions include Adobe Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 (Windows and OS X), before 11.2.202.554 (Linux), Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204. This is one of many similar issues disclosed in the December 2015 security bulletin.

Exploitation

An attacker must host a malicious SWF file and convince a user to visit a malicious page or open the file [1]. No additional authentication or network position is required beyond delivering the crafted Flash content. The exploit leverages the use-after-free condition by passing specific arguments to setTransform on a Color object, thereby gaining control of program flow.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process [1]. This can lead to full system compromise, including data theft, installation of malware, or further escalation. The CVSS score of 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P) reflects partial impacts to confidentiality, integrity, and availability.

Mitigation

Adobe released fixed versions on December 8, 2015 [1]. Users should upgrade to Flash Player 20.0.0.228 (or 18.0.0.268 for legacy branches), AIR 20.0.0.204, or Linux Flash Player 11.2.202.554. Gentoo users can upgrade to >=www-plugins/adobe-flash-11.2.202.559 [2]. No workaround is available; the only mitigation is to apply the patch or disable Flash.