PT-2014-3693 · Adobe+3 · Air Sdk & Compiler+6

Published 2014-11-11 · Updated 2018-12-13 · CVE-2014-0589

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.252 Adobe Flash Player versions 14.x Adobe Flash Player versions 15.x prior to 15.0.0.223 Adobe Flash Player version 11.2.202.418 and earlier on Linux Adobe AIR versions prior to 15.0.0.356 Adobe AIR SDK versions prior to 15.0.0.356 Adobe AIR SDK & Compiler versions prior to 15.0.0.356

Description A heap-based buffer overflow issue allows attackers to execute arbitrary code via unspecified vectors.

Recommendations For Adobe Flash Player versions prior to 13.0.0.252, update to version 13.0.0.252 or later. For Adobe Flash Player versions 14.x, update to version 15.0.0.223 or later. For Adobe Flash Player versions 15.x prior to 15.0.0.223, update to version 15.0.0.223 or later. For Adobe Flash Player version 11.2.202.418 and earlier on Linux, update to version 11.2.202.418 or later. For Adobe AIR versions prior to 15.0.0.356, update to version 15.0.0.356 or later. For Adobe AIR SDK versions prior to 15.0.0.356, update to version 15.0.0.356 or later. For Adobe AIR SDK & Compiler versions prior to 15.0.0.356, update to version 15.0.0.356 or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2014-2342

CVE-2014-0589

MGASA-2014-0448

OPENSUSE-SU-2014_1444-1

RHSA-2014:1852

RHSA-2014_1852

Affected Products

Alt Linux

Air

Air Sdk

Air Sdk & Compiler

Flash Player

Red Hat

Suse

References · 71

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_uncompress_zlib_uninitialized.rb · Exploit
• https://cve.org/CVERecord?id=CVE-2014-0589 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0583 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0574 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8438 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-2342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0589 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0589 · Vendor Advisory
• http://helpx.adobe.com/security/products/flash-player/apsb14-24.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0588 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0576 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0586 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0584 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8440 · Security Note