Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbitrary code execution. Exploitation of this issue requires an attacker to insert malicious strings in an HTTP response that is by default delivered over TLS/SSL.
Weakness
The product dereferences a pointer that it expects to be valid but is NULL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Flash_player | Adobe | * | 32.0.0.433 (including) |
| Red Hat Enterprise Linux 6 Supplementary | RedHat | flash-plugin-0:32.0.0.445-1.el6_10 | * |
| Adobe-flashplugin | Ubuntu | bionic | * |
| Adobe-flashplugin | Ubuntu | trusty | * |
| Adobe-flashplugin | Ubuntu | xenial | * |
| Flashplugin-nonfree | Ubuntu | bionic | * |
| Flashplugin-nonfree | Ubuntu | esm-apps/bionic | * |
| Flashplugin-nonfree | Ubuntu | esm-apps/focal | * |
| Flashplugin-nonfree | Ubuntu | esm-apps/xenial | * |
| Flashplugin-nonfree | Ubuntu | focal | * |
| Flashplugin-nonfree | Ubuntu | trusty | * |
| Flashplugin-nonfree | Ubuntu | xenial | * |