CVE-2015-0332

Vulnerability

Adobe Flash Player before 13.0.0.277, 14.x through 17.x before 17.0.0.134 on Windows and OS X, and before 11.2.202.451 on Linux contains a memory corruption vulnerability that can be triggered via unspecified vectors [1][2]. The flaw allows an attacker to cause memory corruption, potentially leading to arbitrary code execution or denial of service.

Exploitation

An attacker can exploit this vulnerability by enticing a user to open a specially crafted Flash file, likely through a web page or email attachment. No additional privileges are required beyond user interaction to open the malicious file. The attack vector is remote, and the exploitation does not require authentication.

Impact

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected user or cause a denial of service (application crash). This could lead to full compromise of the system's confidentiality, integrity, and availability depending on the user's privileges.

Mitigation

The vulnerability is fixed in Adobe Flash Player 13.0.0.277, 17.0.0.134, and 11.2.202.451 for the respective platforms [1][2]. Red Hat and Gentoo advisories recommend upgrading to these versions. No workarounds are known. Users should update immediately. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.