PT-2014-3693 · Adobe+3 · Air Sdk & Compiler+6

Publicado 2014-11-11 · Atualizado 2018-12-13 · CVE-2014-0589

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.252 Adobe Flash Player versions 14.x Adobe Flash Player versions 15.x prior to 15.0.0.223 Adobe Flash Player version 11.2.202.418 and earlier on Linux Adobe AIR versions prior to 15.0.0.356 Adobe AIR SDK versions prior to 15.0.0.356 Adobe AIR SDK & Compiler versions prior to 15.0.0.356

Description A heap-based buffer overflow issue allows attackers to execute arbitrary code via unspecified vectors.

Recommendations For Adobe Flash Player versions prior to 13.0.0.252, update to version 13.0.0.252 or later. For Adobe Flash Player versions 14.x, update to version 15.0.0.223 or later. For Adobe Flash Player versions 15.x prior to 15.0.0.223, update to version 15.0.0.223 or later. For Adobe Flash Player version 11.2.202.418 and earlier on Linux, update to version 11.2.202.418 or later. For Adobe AIR versions prior to 15.0.0.356, update to version 15.0.0.356 or later. For Adobe AIR SDK versions prior to 15.0.0.356, update to version 15.0.0.356 or later. For Adobe AIR SDK & Compiler versions prior to 15.0.0.356, update to version 15.0.0.356 or later.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2014-2342

CVE-2014-0589

MGASA-2014-0448

OPENSUSE-SU-2014_1444-1

RHSA-2014:1852

RHSA-2014_1852

Produtos afetados

Alt Linux

Air

Air Sdk

Air Sdk & Compiler

Flash Player

Red Hat

Suse

Referências · 71

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_uncompress_zlib_uninitialized.rb · Exploit
• http://support.novell.com/security/cve/CVE-2014-8437.html · Nota
• http://support.novell.com/security/cve/CVE-2014-0581.html · Nota
• https://cve.org/CVERecord?id=CVE-2014-0589 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0583 · Nota de Segurança
• http://support.novell.com/security/cve/CVE-2014-0586.html · Nota
• https://exploit-db.com/exploits/36880 · Nota
• https://access.redhat.com/security/cve/CVE-2014-8440 · Nota
• http://support.novell.com/security/cve/CVE-2014-0590.html · Nota
• https://bugzilla.suse.com/show_bug.cgi?id=905032 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0574 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8438 · Nota de Segurança
• http://support.novell.com/security/cve/CVE-2014-8441.html · Nota
• http://support.novell.com/security/cve/CVE-2014-0588.html · Nota
• https://errata.altlinux.org/ALT-PU-2014-2342 · Aviso do Fabricante