CVE-2015-8405

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux…

published December 10, 2015

CVSS
—
EPSS
6%
Percentile
93.0
In the wild
Unconfirmed
What it is

🚨 A use-after-free vulnerability in Adobe Flash Player could let attackers execute arbitrary code, like a magician pulling a rabbit from an empty hat! 🎩 Think of a restaurant kitchen where a chef accidentally keeps using a pan that was just thrown out for being faulty — any dish that gets prepared could come out wrong or even dangerous! This vulnerability works similarly, allowing attackers to exploit resources that should no longer be available. If exploited, an attacker could gain control over a user's system, leading to malicious code execution. Imagine someone breaking into your home while you're away, rummaging through your belongings, or even stealing your valuables—this vulnerability could let bad actors do just that with your system!

Put simply

Think of a restaurant kitchen where a chef accidentally keeps using a pan that was just thrown out for being faulty — any dish that gets prepared could come out wrong or even dangerous! This vulnerability works similarly, allowing attackers to exploit resources that should no longer be available. This use-after-free vulnerability allows an attacker to execute arbitrary code by manipulating memory resources that the Flash Player was supposed to have released. This can happen through unspecified vectors, making it particularly sneaky!

What to do

If exploited, an attacker could gain control over a user's system, leading to malicious code execution. Imagine someone breaking into your home while you're away, rummaging through your belongings, or even stealing your valuables—this vulnerability could let bad actors do just that with your system! Make sure to update your Adobe Flash Player to versions 18.0.0.268 or later, and versions 19.x and 20.x to 20.0.0.228 or later for Windows and macOS. For Linux users, update to version 11.2.202.554 or later to close this loophole. Don't forget to check and update Adobe AIR or its SDK versions too! You've got this! Follow these steps and keep your system secure—your security hero status is activated! 🦸

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05754 · 93.0th percentile
Published
2015-12-10T02:00Z
EPSS history
Timeline
  • 10 DEC 02:00Z
    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux…
    cvelistv5