Understanding Flash Exploitation and the Alleged CVE-2015-0359 Exploit
Summary: Palo Alto Networks Unit 42 analyzed an Angler Exploit Kit sample (MD5: 049ff69bc23f36a78d86bbf1356c2f63c) that allegedly exploits CVE-2015-0359, but concluded the embedded SWF instead triggers a use-after-free vulnerability they named CVE-2015-X, not the double-free described for CVE-2015-0359. The root cause is a ByteArray copy constructor that reuses the same ByteArray::Buffer reference for shareable byte arrays while initializing m_subscribers to an empty list, so subscribers are never notified when the buffer is freed and later reference a dangling pointer.
Why it matters: The timeline in the source suggests attackers had a full month to create and use CVE-2015-X against Flash Player 17.0.0.134 as a 0-day, and the in-the-wild exploits for both CVE-2015-0313 and CVE-2015-X used workers to reach the vulnerable code.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-0313CVE-2015-0359
- Related
- The Latest Flash UAF Vulnerabilities in Exploit Kits Cyber Risks ·CVE-2015-0313: Adobe Flash Player Use-After-Free Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022Yet Another Flash Patch Fixes Zero-Day Flaw Cyber Risks ·