PT-2014-1344 · Adobe+2 · Flash Player+2

Published 2014-03-27 · Updated 2014-06-21 · CVE-2014-0510

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player version 12.0.0.77

Description A heap-based buffer overflow issue allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism. This was demonstrated by Zeguang Zhao and Liang Chen during a Pwn2Own competition at CanSecWest 2014. The issue can be exploited via unspecified vectors.

Recommendations For Adobe Flash Player version 12.0.0.77, update to a newer version to mitigate the risk of exploitation. As a temporary workaround, consider restricting access to Flash content until a patch is available.

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-00204

BDU:2015-00266

CVE-2014-0510

MGASA-2014-0220

RHSA-2014:0496

RHSA-2014_0496

SUSE-SU-2014_0671-1

ZDI-14-130

Affected Products

Flash Player

Red Hat

Suse

References · 49

• https://bdu.fstec.ru/vul/2015-00281 · Security Note
• https://bdu.fstec.ru/vul/2015-00204 · Security Note
• https://bdu.fstec.ru/vul/2015-00210 · Security Note
• https://bdu.fstec.ru/vul/2015-00279 · Security Note
• http://security.gentoo.org/glsa/glsa-201406-08.xml · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0519 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0520 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0220 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00278 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-14-130 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00008.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0517 · Security Note
• https://bdu.fstec.ru/vul/2015-00280 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0518 · Security Note
• https://advisories.mageia.org/MGASA-2014-0220.html · Security Note