PT-2014-1343 · Adobe+3 · Flash Player+3

Published 2014-04-28 · Updated 2018-12-13 · CVE-2014-0515

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 11.7.700.279 Adobe Flash Player versions 11.8.x through 13.0.x prior to 13.0.0.206 Adobe Flash Player versions prior to 11.2.202.356 on Linux

Description A buffer overflow issue allows remote attackers to execute arbitrary code via unspecified vectors. This issue has been exploited in the wild. The buffer overflow enables attackers to run arbitrary code, posing a significant security risk.

Recommendations For Adobe Flash Player versions prior to 11.7.700.279, update to version 11.7.700.279 or later. For Adobe Flash Player versions 11.8.x through 13.0.x prior to 13.0.0.206, update to version 13.0.0.206 or later. For Adobe Flash Player versions prior to 11.2.202.356 on Linux, update to version 11.2.202.356 or later.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2014-1567

BDU:2015-00203

BDU:2015-00263

CVE-2014-0515

MGASA-2014-0198

OPENSUSE-SU-2014_0585-1

OPENSUSE-SU-2014_0589-1

RHSA-2014:0447

RHSA-2014_0447

SUSE-SU-2014_0605-1

Affected Products

Alt Linux

Flash Player

Red Hat

Suse

References · 31

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_pixel_bender_bof.rb · Exploit
• 🔥 https://exploit-db.com/exploits/33333 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00001.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00203 · Security Note
• https://bdu.fstec.ru/vul/2015-00263 · Security Note
• http://helpx.adobe.com/security/products/flash-player/apsb14-13.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0515 · Security Note
• https://advisories.mageia.org/MGASA-2014-0198.html · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0515 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0447.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201405-04.xml · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00017.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00000.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0198 · Vendor Advisory