CVE-2015-0326

Vulnerability

Adobe Flash Player versions prior to 13.0.0.269 on Windows and OS X, 14.x through 16.x prior to 16.0.0.305 on Windows and OS X, and versions prior to 11.2.202.442 on Linux are affected by a NULL pointer dereference vulnerability [1]. The vulnerability is triggered via unknown vectors, and it is distinct from CVE-2015-0325 and CVE-2015-0328.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious SWF file or webpage that causes a NULL pointer dereference in Flash Player. The attack requires no authentication and can be delivered remotely via web pages or email attachments. The specific details of the exploit vectors have not been disclosed by the vendor.

Impact

Successful exploitation leads to a denial of service condition, causing the affected Flash Player instance to crash. The description also notes the possibility of unspecified other impacts, but no additional details are provided. The crash affects the browser or application hosting the Flash Player.

Mitigation

Adobe released updates to address this vulnerability: Flash Player 13.0.0.269, 16.0.0.305, and 11.2.202.442 for the respective platforms [2][3]. Users should upgrade to these or later versions. For Windows and OS X, updates are available from Adobe; for Linux, users should obtain version 11.2.202.442 from their distribution. No workaround is available.