PT-2014-1364 · Adobe+3 · Flash Player+6

Published 2014-09-09 · Updated 2017-08-29 · CVE-2014-0554

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.244 Adobe Flash Player versions 14.x Adobe Flash Player versions 15.x prior to 15.0.0.152 Adobe AIR versions prior to 15.0.0.249 on Windows and OS X Adobe AIR versions prior to 15.0.0.252 on Android Adobe AIR SDK versions prior to 15.0.0.249 Adobe AIR SDK & Compiler versions prior to 15.0.0.249

Description The issue allows attackers to bypass intended access restrictions.

Recommendations For Adobe Flash Player versions prior to 13.0.0.244, update to version 13.0.0.244 or later. For Adobe Flash Player versions 14.x, update to version 15.0.0.152 or later. For Adobe Flash Player versions 15.x prior to 15.0.0.152, update to version 15.0.0.152 or later. For Adobe AIR versions prior to 15.0.0.249 on Windows and OS X, update to version 15.0.0.249 or later. For Adobe AIR versions prior to 15.0.0.252 on Android, update to version 15.0.0.252 or later. For Adobe AIR SDK versions prior to 15.0.0.249, update to version 15.0.0.249 or later. For Adobe AIR SDK & Compiler versions prior to 15.0.0.249, update to version 15.0.0.249 or later.

Exploit

Fix

Related Identifiers

ALT-PU-2014-2119

BDU:2015-00224

BDU:2015-00304

BDU:2015-00305

CVE-2014-0554

MGASA-2014-0382

OPENSUSE-SU-2014_1110-1

OPENSUSE-SU-2014_1130-1

RHSA-2014:1173

RHSA-2014_1173

Affected Products

Alt Linux

Air

Air Sdk

Air Sdk & Compiler

Flash Player

Red Hat

Suse

References · 96

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_copy_pixels_to_byte_array.rb · Exploit
• http://helpx.adobe.com/security/products/flash-player/apsb14-21.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-00286 · Security Note
• https://bdu.fstec.ru/vul/2015-00269 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0556 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0551 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0550 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0552 · Security Note
• https://bdu.fstec.ru/vul/2015-00295 · Security Note
• https://bdu.fstec.ru/vul/2015-00233 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00016.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0548 · Security Note
• https://bdu.fstec.ru/vul/2015-00307 · Security Note
• https://bdu.fstec.ru/vul/2015-00291 · Security Note
• https://bdu.fstec.ru/vul/2015-00205 · Security Note