CVE-2015-8642

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions before 18.0.0.324, 19.x and 20.x before 20.0.0.267 on Windows and OS X, and before 11.2.202.559 on Linux, as well as in Adobe AIR before 20.0.0.233 and related SDKs. The flaw occurs through unspecified vectors and is triggered when the application mishandles object memory references.[1][2]

Exploitation

An attacker can exploit this vulnerability by delivering a crafted SWF file that triggers the use-after-free condition. No specific user interaction beyond opening the malicious content (e.g., visiting a compromised website or opening an email attachment) is required. The attacker does not need prior authentication or local access, only the ability to serve the malicious file to a vulnerable player.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected Flash process. This can lead to full system compromise, including installation of programs, data viewing/changing/deletion, or creation of new accounts with full user rights. The impact is limited by the privileges of the user running Flash.[1][2]

Mitigation

Adobe released fixed versions: Flash Player 20.0.0.267 (or 11.2.202.559 on Linux), AIR 20.0.0.233, and corresponding SDK updates. Red Hat issued RHSA-2015:2697 providing updates for affected RHEL packages[1]. Gentoo recommends upgrading to >=www-plugins/adobe-flash-11.2.202.559[2]. No workarounds were available at disclosure time; users should apply the latest updates promptly.