CVE-2015-0339

Vulnerability

A memory corruption vulnerability exists in Adobe Flash Player versions prior to 13.0.0.277, 14.x through 17.x before 17.0.0.134 on Windows and OS X, and before 11.2.202.451 on Linux [1][2]. The flaw is triggered via unspecified vectors, likely involving crafted SWF content, and does not require any special configuration beyond having an affected version installed.

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by delivering a malicious SWF file, typically through a compromised website or via an ad network. The victim must open the crafted content in a browser or application using the vulnerable Flash Player. No additional privileges or user interaction beyond visiting the malicious page is required. The memory corruption is triggered during processing of the SWF file, allowing the attacker to control execution flow.

Impact

Successful exploitation allows the attacker to execute arbitrary code with the privileges of the user running Flash Player, or to cause a denial of service (application crash). This can lead to full system compromise if the user has administrative rights. The vulnerability may also be leveraged for information disclosure, though the primary impact is code execution and DoS [1][2].

Mitigation

Adobe released fixed versions on March 12, 2015: 13.0.0.277, 17.0.0.134 for Windows and OS X, and 11.2.202.451 for Linux [1][2]. Users should update immediately. No workarounds are available. Flash Player is now end-of-life, but at the time of disclosure, updating to the patched versions was the only mitigation.