CVE-2015-8438

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 18.0.0.268 Adobe Flash Player versions 19.x Adobe Flash Player versions 20.x prior to 20.0.0.228 Adobe AIR versions prior to 20.0.0.204 Adobe AIR SDK versions prior to 20.0.0.204 Adobe AIR SDK & Compiler versions prior to 20.0.0.204 Adobe Flash Player version prior to 11.2.202.554 on Linux

Description The issue is caused by a heap-based buffer overflow in the dynamic memory of Adobe Flash Player and Adobe Integrated Runtime. This can be exploited by a remote attacker using a specially crafted XML object during a toString call, allowing the execution of arbitrary code.

Recommendations For Adobe Flash Player versions prior to 18.0.0.268, update to version 18.0.0.268 or later. For Adobe Flash Player versions 19.x, update to a version that is not affected by this issue. For Adobe Flash Player versions 20.x prior to 20.0.0.228, update to version 20.0.0.228 or later. For Adobe AIR versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe AIR SDK versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe AIR SDK & Compiler versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe Flash Player version prior to 11.2.202.554 on Linux, update to version 11.2.202.554 or later. As a temporary workaround, consider restricting the use of the toString call on crafted XML objects until a patch is available.