CVE-2015-0329

Vulnerability

Adobe Flash Player versions before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X, and before 11.2.202.442 on Linux, are affected by a memory corruption vulnerability (CVE-2015-0329). The flaw can be triggered via unspecified vectors, meaning an attacker can craft a malicious SWF file that, when processed by the Flash Player, corrupts memory [3].

Exploitation

An attacker must deliver a specially crafted SWF file to the target, typically by hosting it on a website or injecting it into a compromised ad network. No authentication is required; user interaction is limited to visiting the page or opening the file. The exploit does not require any special network position beyond the ability to serve the malicious content [3].

Impact

Successful exploitation can lead to arbitrary code execution within the security context of the user running Flash Player, or cause a denial of service due to memory corruption. An attacker could gain full control of the affected system, install programs, view/change/delete data, or create new accounts with complete user rights [2][3].

Mitigation

Adobe released fixed versions: 13.0.0.269, 16.0.0.305, and 11.2.202.442. Users on Windows and OS X should update to Flash Player 16.0.0.305 or later; Linux users to 11.2.202.442 [3]. Microsoft provided updates for affected Internet Explorer and Edge environments [1]. Red Hat issued RHSA-2015:0140 for Red Hat Enterprise Linux [2]. No workaround is known [3].