CVE-2015-8437

Use-after-free vulnerability in the Selection object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and…

published December 10, 2015

CVSS
—
EPSS
7%
Percentile
93.8
In the wild
Unconfirmed
What it is

🚨 A sneaky use-after-free vulnerability lurks in Adobe Flash Player! This flaw allows attackers to execute arbitrary code simply through a crafted `setFocus` call, making it a recipe for disaster! 🔥 Think of it like a restaurant where the chef mistakenly leaves the back door open, allowing anyone to waltz in and cook whatever they want—disastrous for diners! An attacker could exploit this vulnerability to run arbitrary code on your system, leading to unauthorized access, data theft, or even complete system takeover. This could spell absolute chaos for users, especially given that many still run outdated versions of Flash Player!

Put simply

Think of it like a restaurant where the chef mistakenly leaves the back door open, allowing anyone to waltz in and cook whatever they want—disastrous for diners! This use-after-free vulnerability in the Selection object implementation occurs when the memory for a previously freed object is erroneously accessed, allowing the execution of malicious code. This affects multiple versions of Adobe Flash Player and Adobe AIR across various operating systems.

What to do

An attacker could exploit this vulnerability to run arbitrary code on your system, leading to unauthorized access, data theft, or even complete system takeover. This could spell absolute chaos for users, especially given that many still run outdated versions of Flash Player! To protect yourself, immediately upgrade to Adobe Flash Player version 18.0.0.268 or later, and ensure you’re using Adobe AIR version 20.0.0.204 or newer. Regularly check for updates and consider disabling Flash, as it's slowly being phased out! You've got this! Following these steps will help you lock down your systems and strengthen your defenses! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06538 · 93.8th percentile
Published
2015-12-10T02:00Z
EPSS history
Timeline
  • 10 DEC 02:00Z
    Use-after-free vulnerability in the Selection object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and…
    cvelistv5