CVE-2015-8421

published 2015-12-10

CVE-2015-8421: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux…

Priority P2 64 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
adobe	air	<= 19.0.0.241	—
adobe	air_desktop_runtime	<= 19.0.0.241	—
adobe	air_sdk	<= 19.0.0.241	—
adobe	air_sdk_compiler	<= 19.0.0.241	—
adobe	flash_player	<= 11.2.202.548	—
adobe	flash_player	<= 18.0.0.261	—
adobe	flash_player	<= 19.0.0.245	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player	—	—
adobe	flash_player_desktop_runtime	<= 19.0.0.245	—

Detection & IOCs extracted from sources · hover to see the quote

url https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39045.zip↗

• → CVE-2015-8421 is a use-after-free triggered via the TextField.thickness setter in Adobe Flash Player. The vulnerability is exploited by passing an object with a custom valueOf function as the thickness parameter, which frees the TextField's parent MovieClip mid-execution and then continues using the freed object. ↗
• → Exploit PoC pattern: a SWF that sets tf.thickness to an object literal with a valueOf callback that calls mc.removeMovieClip() to free the parent clip during the setter evaluation. Detection of SWF files containing TextField thickness assignment with an object valueOf callback may indicate exploitation attempts. ↗
• → Affected versions: Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X, and before 11.2.202.554 on Linux. Block or alert on these version strings in User-Agent or plugin inventory. ↗

• · The NVD source document is for CVE-2015-8067, not CVE-2015-8421 directly; CVE-2015-8421 is listed as one of many related use-after-free variants sharing the same affected version ranges and advisory. ↗
• · The exploit PoC is a SWF/FLA pair distributed as a ZIP archive. The heap-fixing step ('Fix heap here') is left as a stub in the published PoC, meaning a weaponized version would include additional heap-spray or grooming code not shown in the source. ↗

CVSS provenance

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

osv 10.0 CRITICAL

vendor_redhat 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416