CVE-2015-8452

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. Adobe AIR before 20.0.0.204, AIR SDK before 20.0.0.204, and AIR SDK & Compiler before 20.0.0.204 are also affected. The flaw is triggered via unspecified vectors, likely involving crafted SWF content that leads to memory corruption [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a malicious SWF file, typically delivered through a web browser or email attachment. No authentication is required, and the attack can be performed remotely. The exact sequence involves the crafted content causing a use-after-free condition in the Flash Player rendering engine [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected process. This can lead to full system compromise, including data theft, installation of malware, or denial of service. The vulnerability is rated as critical with a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) [1].

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.228 (or 18.0.0.268 for older branches) on Windows and OS X, 11.2.202.554 on Linux, and AIR 20.0.0.204. Gentoo recommends upgrading to 11.2.202.559 for Linux users. No workaround is available; users must apply the update [1].