CVE-2015-8647

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions before 18.0.0.324, 19.x and 20.x before 20.0.0.267 on Windows and OS X, and before 11.2.202.559 on Linux. It also affects Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233. The flaw is triggered by unspecified vectors and is distinct from several other vulnerabilities disclosed at the same time [1][2].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted Flash file, likely delivered via a web page or email attachment. No authentication is required, and the user interaction consists only of visiting a compromised site or opening a malicious file. The exact exploitation steps are not detailed in the available references, but the vulnerability is remotely exploitable [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the affected user's application, typically the web browser plugin. This can lead to full system compromise, including data theft, installation of malware, or further lateral movement within a network. The CVSS v3 base score is 8.8, indicating high severity [1][2].

Mitigation

Adobe has released updated versions: Flash Player 20.0.0.267 (and 11.2.202.559 for Linux), AIR 20.0.0.233, AIR SDK 20.0.0.233, and AIR SDK & Compiler 20.0.0.233. Red Hat and Gentoo have also issued advisories recommending updates [1][2]. Users should apply these updates immediately. No workaround is known for this vulnerability.