CVE-2015-8448

Vulnerability

CVE-2015-8448 is a use-after-free vulnerability in the DisplacementMapFilter object of Adobe Flash Player. Affected versions include Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux, as well as Adobe AIR before 20.0.0.204 and associated SDKs. The flaw is triggered by manipulating the mapBitmap property, causing a dangling pointer to be reused after the object has been freed [1].

Exploitation

An attacker requires user interaction, such as visiting a malicious webpage or opening a crafted SWF file. No authentication or prior access is needed. The exploit involves setting a specially crafted mapBitmap property on a DisplacementMapFilter object, which forces a use-after-free condition that can be leveraged to execute arbitrary code within the Flash Player process [1].

Impact

Successful exploitation allows arbitrary code execution in the context of the current process, which typically runs with the privileges of the user. This can lead to full system compromise, including data theft, installation of malware, and further propagation. The CVSS v2 score is 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P), indicating partial confidentiality, integrity, and availability impact [1][2].

Mitigation

Adobe released fixed versions: Flash Player 18.0.0.268, 20.0.0.228, and Linux 11.2.202.554; Adobe AIR 20.0.0.204. Users should update to these or later versions. Gentoo Linux recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559 [2]. No workarounds are available beyond applying the patch [2].