CVE-2015-0323

Vulnerability

A heap-based buffer overflow vulnerability exists in Adobe Flash Player versions before 13.0.0.269, 14.x through 16.x before 16.0.0.305 on Windows and OS X, and before 11.2.202.442 on Linux. The flaw can be triggered by unspecified vectors, allowing an attacker to corrupt heap memory [1][2][3].

Exploitation

An attacker can exploit the vulnerability by convincing a user to open a specially crafted SWF file or visit a malicious web page that hosts the crafted content. No authentication is required, and the user interaction is limited to typical browsing or file opening actions. The exact exploitation steps are not detailed in the references, but the vector is remote [1][2][3].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the affected Flash Player process. This can lead to full system compromise, including data disclosure, installation of malware, or further lateral movement within the victim's network. The vulnerability is rated as critical with a CVSS v2 score of 10.0 [1][2].

Mitigation

Adobe released Flash Player versions 13.0.0.269, 16.0.0.305, and 11.2.202.442 that fix this issue. Platform-specific updates are available from Adobe, and Microsoft and Red Hat also released security updates for affected distributions [1][2]. Gentoo recommends upgrading to >=www-plugins/adobe-flash-11.2.202.442 [3]. Users should apply the updates immediately; no workaround is available [1][2][3].