PT-2014-8525 · Adobe+2 · Flash Player+5

Published 2014-11-11 · Updated 2018-12-20 · CVE-2014-8442

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 13.0.0.252 Adobe Flash Player versions 14.x Adobe Flash Player versions 15.x prior to 15.0.0.223 Adobe Flash Player version 11.2.202.418 and earlier on Linux Adobe AIR versions prior to 15.0.0.356 Adobe AIR SDK versions prior to 15.0.0.356 Adobe AIR SDK & Compiler versions prior to 15.0.0.356

Description The issue allows attackers to complete a transition from Low Integrity to Medium Integrity by leveraging incorrect permissions.

Recommendations For Adobe Flash Player versions prior to 13.0.0.252, update to version 13.0.0.252 or later. For Adobe Flash Player versions 14.x, update to a version outside of the 14.x range. For Adobe Flash Player versions 15.x prior to 15.0.0.223, update to version 15.0.0.223 or later. For Adobe Flash Player version 11.2.202.418 and earlier on Linux, update to version 11.2.202.418 or later. For Adobe AIR versions prior to 15.0.0.356, update to version 15.0.0.356 or later. For Adobe AIR SDK versions prior to 15.0.0.356, update to version 15.0.0.356 or later. For Adobe AIR SDK & Compiler versions prior to 15.0.0.356, update to version 15.0.0.356 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2014-2342

CVE-2014-8442

MGASA-2014-0448

OPENSUSE-SU-2014_1444-1

Affected Products

Alt Linux

Air

Air Sdk

Air Sdk & Compiler

Flash Player

Suse

References · 55

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flash_uncompress_zlib_uninitialized.rb · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0573 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-8442 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0583 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0581 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0574 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0590 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0576 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0586 · Security Note
• http://helpx.adobe.com/security/products/flash-player/apsb14-24.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0582 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-8442 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8440 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8442 · Security Note