CVE-2015-5561

published 2015-08-14

CVE-2015-5561: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe…

Priority P2 64 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before 18.0.0.199, Adobe AIR SDK before 18.0.0.199, and Adobe AIR SDK & Compiler before 18.0.0.199 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-5127, CVE-2015-5130, CVE-2015-5134, CVE-2015-5539, CVE-2015-5540, CVE-2015-5550, CVE-2015-5551, CVE-2015-5556, CVE-2015-5557, CVE-2015-5559, CVE-2015-5563, CVE-2015-5564, and CVE-2015-5565.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
adobe	air	<= 18.0.0.180	—
adobe	air_sdk	<= 18.0.0.180	—
adobe	air_sdk_compiler	<= 18.0.0.180	—
adobe	flash_player	<= 11.2.202.491	—
adobe	flash_player	<= 18.0.0.209	—
opensuse	evergreen	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37883.zip↗

• → Use-after-free triggered via ActionScript 2 TextField.filters array property — monitor Flash processes for UAF crash patterns involving TextField.filters assignment and GlowFilter constructor override ↗
• → Exploit abuses custom __proto__ with addProperty('GlowFilter', ...) to execute AS2 during filter name retrieval, before the UAF mitigation flag is set — look for AS2 code setting flash.filters to a custom object with overridden GlowFilter property ↗
• → Crash/exploitation indicator: dereference of 0x41424344 in Flash Player process — heap spray pattern using 0x41424344 as fill value in tabStops arrays ↗
• → Affected versions: Flash Player before 18.0.0.232 (Windows/OS X), before 11.2.202.508 (Linux); Adobe AIR before 18.0.0.199 — flag for exploitation attempts on these specific versions ↗
• → Exploit was confirmed on Flash Player standalone 18.0.0.160 and Chrome 43.0.2357.124 on Windows 7 x64 SP1 — correlate crash telemetry on these platform/version combinations ↗

• · The exploit requires compilation with Flash CS 5.5 to produce a working .fla payload — detection of the compiled SWF artifact is more reliable than source-level detection ↗
• · Flash 17.0.0.169 and 18.0.0.160 each added mitigation flags for prior related issues (457278, 476926), but the exploit bypasses both by triggering AS2 execution earlier in the same function before the flags are set ↗

CVSS provenance

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

osv 10.0 CRITICAL

vendor_redhat 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.