Product:
Adobe Flash Player
Summary
A use-after-free vulnerability exists in the ByteArray class of the ActionScript 3 implementation in Adobe Flash Player. This vulnerability affects multiple versions on Windows, OS X, and Linux, allowing remote attackers to execute arbitrary code or cause a denial of service through crafted Flash content. It was actively exploited in the wild in July 2015.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2015-5119 |
Exploitation
To exploit this vulnerability, an attacker can create malicious Flash content that overrides the valueOf function within the ByteArray class. When a user interacts with this content, it can lead to memory corruption, allowing the attacker to execute arbitrary code on the victim’s system. This can be done without any user authentication or interaction, making it particularly dangerous.
Affected Products
- Adobe Flash Player 13.x through 13.0.0.296 on Windows and OS X
- Adobe Flash Player 14.x through 18.0.0.194 on Windows and OS X
- Adobe Flash Player 11.x through 11.2.202.468 on Linux
Mitigation
The impacted product is no longer supported and has reached end-of-life status. Users are strongly advised to disconnect the product from their systems if it is still in use to prevent potential exploitation.
References
- Trend Micro Blog
- OpenSUSE Security Announcement 1
- OpenSUSE Security Announcement 2
- OpenSUSE Security Announcement 3
- OpenSUSE Security Announcement 4
- Red Hat Errata
- CERT Vulnerability Database
- Rapid7 Exploit Module
- SecurityFocus BID
- SecurityTracker ID
- US-CERT Alert
- Adobe Security Advisory 1
- Adobe Security Advisory 2
- Packet Storm Security
- Gentoo GLSA
- CISA Known Exploited Vulnerabilities