# MA-494.072015: MyCERT Advisory - Security Updates for Flash AS3 opaqueBackground and BitmapData Use-After-Free Vulnerabilities

**Date:** 15 Jul 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-494.072015  
**Advisory ID:** MA-494.072015

---

#### **1.0 Introduction**
Adobe Flash Player contains critical vulnerabilities within the ActionScript 3 opaqueBackground and BitmapData classes. Exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code on a vulnerable system.
Users and administrators are encouraged to review Adobe Security Advisory APSA15-04, as well as Vulnerability Notes VU#338736 and VU#918568 for workaround information. No patch is currently available.
**2.0 Impact**
These updates address vulnerabilities that could potentially allow a remote attacker to execute arbitrary code in the context of the user running Flash Player. Attacks typically involve enticing a user to visit a web site containing specially crafted Flash content, or to open a specially crafted Microsoft Office document.
**3.0 Affected Products**
The detail lists of the affected products are as below:
- Adobe Flash Player 18.0.0.203 and earlier versions for Windows and Macintosh
- Adobe Flash Player 18.0.0.204 and earlier versions for Linux installed with Google Chrome
- Adobe Flash Player Extended Support Release version 13.0.0.302 and earlier 13.x versions for Windows and Macintosh
- Adobe Flash Player Extended Support Release version 11.2.202.481 and earlier 11.x versions for Linux.
**4.0 Recommendation**
Adobe recommends users update their product to the latest version by following the links provided below:
> Flash Player Desktop Runtime of earlier versions should update to 18.0.0.209 via this URL:
- http://www.adobe.com/go/getflash
- http://www.adobe.com/products/players/flash-player-distribution.html
> Flash Player Extended Support Release:
- https://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html
> Flash Player for Google Chrome:
- http://googlechromereleases.blogspot.com
> Flash Player for Internet Explorer 10 and 11 of earlier versions should update to 18.0.0.209 via this URL:
- http://go.microsoft.com/fwlink/?LinkId=264959
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : https://www.mycert.org.my
Twitter : http://www.twitter.com/mycert
Facebook: http://www.facebook.com/mycert.org.my
Cyber999 Mobile Apps:  IOS Users or Android Users
**5.0 References**
Workarounds for Adobe Flash AS3 opaqueBackground and BitmapData Use-After-Free Vulnerabilities
- https://www.us-cert.gov/ncas/current-activity/2015/07/11/Adobe-Flash-ActionScript-3-opaqueBackground-Use-After-Free
Adobe Security Bulletin
- https://helpx.adobe.com/security/products/flash-player/apsb15-18.html
Vulnerability Note VU#338736
- http://www.kb.cert.org/vuls/id/338736
Vulnerability Note VU#918568
- http://www.kb.cert.org/vuls/id/918568