CVE-2015-8449

Vulnerability

CVE-2015-8449 is a use-after-free vulnerability in the MovieClip object implementation of Adobe Flash Player [1]. The flaw resides in how the lineTo method handles object lifetime. An attacker can craft a malicious SWF file that, when processed by Flash Player, triggers a dangling pointer after the associated memory has been freed. The affected versions are Flash Player before 18.0.0.268, 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux; Adobe AIR before 20.0.0.204, and corresponding AIR SDK/SDK & Compiler versions.

Exploitation

Exploitation requires user interaction: the target must visit a malicious web page or open a crafted file containing the vulnerable SWF content [1]. No additional authentication or special privileges are needed. The attacker triggers the flaw by calling the lineTo method on a MovieClip object in ActionScript 2, causing the reuse of a freed pointer [1]. This can be leveraged to corrupt memory and redirect execution flow.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the user running the Flash Player instance [1]. This leads to full compromise of the affected system, including potential data theft, malware installation, or further network propagation.

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228, 18.0.0.268, and 11.2.202.554 on Linux, as well as AIR 20.0.0.204, on December 8, 2015 [1][2]. Users should update to these or later versions. There is no known workaround; disabling or removing Flash Player if not needed also mitigates risk.