Exploitable NULL pointer deref could lead to arbitrary code execution
CVE-2020-9746

7HIGH

Key Information:

Vendor
Adobe
Status
Flash Player
Vendor
CVE Published:
14 October 2020

Summary

Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and arbitrary code execution. Exploitation of this issue requires an attacker to insert malicious strings in an HTTP response that is by default delivered over TLS/SSL.

Affected Version(s)

Flash Player <= 32.0.0.387

Flash Player <= 32.0.0.433

Flash Player <= unspecified

References

https://helpx.adobe.com/security/products/flash-player/ap...
x_refsource_MISC

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.