CVE-2015-8648

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player before 18.0.0.324 and 19.x through 20.x before 20.0.0.267 on Windows and OS X, and before 11.2.202.559 on Linux. It also affects Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233. The flaw can be triggered via unspecified vectors, allowing an attacker to corrupt memory [1][2].

Exploitation

An attacker can exploit this vulnerability by enticing a user to open a specially crafted Flash file (e.g., via a malicious web page or email attachment). No additional privileges are required besides normal user interaction; the attack can be performed remotely. The exact exploitation steps are not publicly detailed beyond the use-after-free condition [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected user. This can lead to complete compromise of confidentiality, integrity, and availability, including potential system takeover, data theft, or malware installation [1][2].

Mitigation

Adobe has released fixed versions: Flash Player 18.0.0.324/20.0.0.267 for Windows and OS X, 11.2.202.559 for Linux, and AIR 20.0.0.233. Users should update immediately. Red Hat and Gentoo have also issued advisories urging upgrades [1][2]. No workarounds are available.