PT-2014-1361 · Adobe+3 · Air Sdk & Compiler+6

Published 2014-07-08 · Updated 2014-08-05 · CVE-2014-0537

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.231 Adobe Flash Player versions 14.x prior to 14.0.0.145 Adobe Flash Player version prior to 11.2.202.394 on Linux Adobe AIR versions prior to 14.0.0.137 on Android Adobe AIR SDK version prior to 14.0.0.137 Adobe AIR SDK & Compiler version prior to 14.0.0.137

Description The issue allows attackers to bypass intended access restrictions via unspecified vectors. This is a different issue than the one previously reported. The vulnerability affects Adobe Flash Player, Adobe AIR, Adobe AIR SDK, and Adobe AIR SDK & Compiler, allowing attackers to bypass access restrictions.

Recommendations For Adobe Flash Player versions prior to 13.0.0.231, update to version 13.0.0.231 or later. For Adobe Flash Player versions 14.x prior to 14.0.0.145, update to version 14.0.0.145 or later. For Adobe Flash Player version prior to 11.2.202.394 on Linux, update to version 11.2.202.394 or later. For Adobe AIR versions prior to 14.0.0.137 on Android, update to version 14.0.0.137 or later. For Adobe AIR SDK version prior to 14.0.0.137, update to version 14.0.0.137 or later. For Adobe AIR SDK & Compiler version prior to 14.0.0.137, update to version 14.0.0.137 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-1934

BDU:2015-00221

BDU:2015-00300

CVE-2014-0537

MGASA-2014-0291

OPENSUSE-SU-2014_0903-1

OPENSUSE-SU-2014_0913-1

RHSA-2014:0860

RHSA-2014_0860

SUSE-SU-2014_0897-1

Affected Products

Alt Linux

Air

Air Sdk

Air Sdk & Compiler

Flash Player

Red Hat

Suse

References · 45

• http://rhn.redhat.com/errata/RHSA-2014-0860.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0537 · Security Note
• https://bdu.fstec.ru/vul/2015-00221 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1934 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4671 · Security Note
• http://helpx.adobe.com/security/products/flash-player/apsb14-17.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0291 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00344 · Security Note
• http://security.gentoo.org/glsa/glsa-201407-02.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00300 · Security Note
• https://bdu.fstec.ru/vul/2015-00301 · Security Note
• https://bdu.fstec.ru/vul/2015-00234 · Security Note
• https://advisories.mageia.org/MGASA-2014-0291.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0537 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00222 · Security Note