PT-2014-2026 · Adobe+3 · Flash Player+6

Kafeine · Published 2014-10-14 · Updated 2025-02-14 · CVE-2014-8439

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.258 Adobe Flash Player versions 14.x and 15.x prior to 15.0.0.239 Adobe Flash Player version prior to 11.2.202.424 on Linux Adobe AIR version prior to 15.0.0.293 Adobe AIR SDK version prior to 15.0.0.302 Adobe AIR SDK & Compiler version prior to 15.0.0.302

Description The issue is related to a buffer overflow operation that can be exploited by a remote attacker to execute arbitrary code or cause a denial of service through unspecified vectors. This can lead to the execution of arbitrary code or a denial of service due to an invalid pointer dereference.

Recommendations For Adobe Flash Player versions prior to 13.0.0.258, update to version 13.0.0.258 or later. For Adobe Flash Player versions 14.x and 15.x prior to 15.0.0.239, update to version 15.0.0.239 or later. For Adobe Flash Player version prior to 11.2.202.424 on Linux, update to version 11.2.202.424 or later. For Adobe AIR version prior to 15.0.0.293, update to version 15.0.0.293 or later. For Adobe AIR SDK version prior to 15.0.0.302, update to version 15.0.0.302 or later. For Adobe AIR SDK & Compiler version prior to 15.0.0.302, update to version 15.0.0.302 or later.

Fix

DoS

Buffer Overflow

Use After Free

Weakness Enumeration

CWE-119

CWE-416

Related Identifiers

ALT-PU-2014-2388

BDU:2021-04944

CVE-2014-8439

MGASA-2014-0497

OPENSUSE-SU-2014_1562-1

RHSA-2014:1915

RHSA-2014_1915

SUSE-SU-2014_1542-1

SUSE-SU-2014_1545-1

Affected Products

Alt Linux

Air

Air Sdk

Air Sdk & Compiler

Flash Player

Red Hat

Suse

References · 39

• http://helpx.adobe.com/security/products/flash-player/apsb14-26.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8439 · Security Note
• https://advisories.mageia.org/MGASA-2014-0497.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-8439 · Security Note
• http://helpx.adobe.com/security/products/flash-player/apsb14-22.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00001.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00020.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8439 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04944 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00004.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-8439 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0497 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-2388 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1915.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-8439 · Vendor Advisory