CVE-2015-0342

Vulnerability

A use-after-free vulnerability exists in Adobe Flash Player versions before 13.0.0.277 and 14.x through 17.x before 17.0.0.134 on Windows and OS X, and before 11.2.202.451 on Linux [1][2]. The flaw allows attackers to leverage unspecified vectors to corrupt memory, leading to arbitrary code execution. The root cause is a use-after-free condition, distinct from CVE-2015-0341 [description].

Exploitation

An attacker can exploit this vulnerability by convincing a user to open a specially crafted Flash (SWF) file, typically through a malicious web page or email attachment. No authentication or special network position is required beyond delivering the crafted content to the target. The unspecified vectors may involve heap manipulation or other memory-corruption techniques, but the exact steps are not publicly detailed.

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected Flash Player process. This can lead to full compromise of the user's system, including data theft, installation of malware, or further lateral movement within a network. The impact is rated as critical, with a CVSS score reflecting high severity [description].

Mitigation

Mitigation is available by upgrading to the fixed versions: 13.0.0.277 or 17.0.0.134 for Windows/OS X, and 11.2.202.451 for Linux [1][2]. Red Hat and Gentoo advisories confirm these updates as of March 2015 [1][2]. No workaround is known; upgrading is the only reliable mitigation [2].