PT-2014-1346 · Adobe+4 · Air Sdk & Compiler+8

Published 2014-09-09 · Updated 2017-08-29 · CVE-2014-0559

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions 13.0.0.244 and earlier, 14.x, 15.x before 15.0.0.152 Adobe AIR versions 15.0.0.249 and earlier on Windows and OS X, 15.0.0.252 and earlier on Android Adobe AIR SDK version 15.0.0.249 and earlier Adobe AIR SDK & Compiler version 15.0.0.249 and earlier Adobe Pepper Flash for Google Chrome (affected versions not specified)

Description A heap-based buffer overflow in Adobe Flash Player, Adobe AIR, Adobe AIR SDK, and Adobe AIR SDK & Compiler allows attackers to execute arbitrary code via unspecified vectors. This issue enables attackers to execute arbitrary code.

Recommendations For Adobe Flash Player versions 13.0.0.244 and earlier, 14.x, 15.x before 15.0.0.152, update to version 13.0.0.244 or later, 15.0.0.152 or later. For Adobe AIR versions 15.0.0.249 and earlier on Windows and OS X, update to version 15.0.0.249 or later. For Adobe AIR versions 15.0.0.252 and earlier on Android, update to version 15.0.0.252 or later. For Adobe AIR SDK version 15.0.0.249 and earlier, update to version 15.0.0.249 or later. For Adobe AIR SDK & Compiler version 15.0.0.249 and earlier, update to version 15.0.0.249 or later. For Adobe Pepper Flash for Google Chrome, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2014-2119

BDU:2015-00206

BDU:2015-00269

BDU:2015-00270

CVE-2014-0559

MGASA-2014-0382

OPENSUSE-SU-2014_1110-1

OPENSUSE-SU-2014_1130-1

RHSA-2014:1173

RHSA-2014_1173

Affected Products

Alt Linux

Air

Air Sdk

Air Sdk & Compiler

Flash Player

Pepper Flash

Google Chrome

Red Hat

Suse

References · 96

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_copy_pixels_to_byte_array.rb · Exploit
• http://helpx.adobe.com/security/products/flash-player/apsb14-21.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00286 · Security Note
• https://bdu.fstec.ru/vul/2015-00269 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0556 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0551 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0550 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0552 · Security Note
• https://bdu.fstec.ru/vul/2015-00295 · Security Note
• https://bdu.fstec.ru/vul/2015-00233 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00016.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0559 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0548 · Security Note
• https://bdu.fstec.ru/vul/2015-00307 · Security Note
• https://bdu.fstec.ru/vul/2015-00291 · Security Note