CVE-2015-8428

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux…

published December 10, 2015

CVSS
—
EPSS
43%
Percentile
98.7
In the wild
Unconfirmed
What it is

⚠️ A startling oversight in Adobe Flash Player could leave your setup vulnerable. This sneaky use-after-free bug allows attackers to execute arbitrary code — like a magician pulling a rabbit from an empty hat! 🐇 Picture a restaurant that forgets to clear out its old orders, leaving the kitchen open to serving expired dishes. That’s what this use-after-free vulnerability does — it forgets to remove old memory references, which can lead to unexpected actions! An attacker could exploit this flaw to run malicious code on your system, potentially leading to complete system compromise. This could mean unauthorized access to sensitive data, or even total system takeover. Yikes!

Put simply

Picture a restaurant that forgets to clear out its old orders, leaving the kitchen open to serving expired dishes. That’s what this use-after-free vulnerability does — it forgets to remove old memory references, which can lead to unexpected actions! This use-after-free vulnerability allows attackers to execute arbitrary code by manipulating memory that should no longer be accessible, specifically in Adobe Flash Player before version 18.0.0.268 and several other specified versions.

What to do

An attacker could exploit this flaw to run malicious code on your system, potentially leading to complete system compromise. This could mean unauthorized access to sensitive data, or even total system takeover. Yikes! To protect your systems, ensure that you patch Adobe Flash Player to the latest version, specifically updating to 18.0.0.268 or later. Verify that all Adobe AIR components are also updated to their secure versions. Remember, staying current is your best defense! You've got this! Keep your systems updated and you'll be well on your way to security hero status! 🦸

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.43408 · 98.7th percentile
Published
2015-12-10T02:00Z
EPSS history
Timeline
  • 10 DEC 02:00Z
    Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux…
    cvelistv5