Unscored severity · published Sep 10, 2014
CVE-2014-0557
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and…
–
CVSS
5.2%
EPSS
No
On KEV
Description
Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.2% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AA
Adobe Air · Adobe
through 14.0.0.178; 13.0.0.83; 13.0.0.111; 14.0.0.110; 14.0.0.137; through 14.0.0.179; +4 more · source: NVD
AA
Adobe Air Sdk · Adobe
through 14.0.0.178; 13.0.0.83; 13.0.0.111; 14.0.0.110; 14.0.0.137 · source: NVD
FP
Flash Player · Adobe
through 11.2.202.400; 11.2.202.223; 11.2.202.228; 11.2.202.233; 11.2.202.235; 11.2.202.236; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0557
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0557
Patch
http://helpx.adobe.com/security/products/flash-player/apsb14-21.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00006.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00016.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00021.html
secunia.com
http://secunia.com/advisories/61089
security.gentoo.org
http://security.gentoo.org/glsa/glsa-201409-05.xml
More from Adobe Air
8.8
CVE-2014-0502
Adobe Flash Player Double Free Vulnerablity
8.8
CVE-2011-0611
Adobe Flash Player Remote Code Execution Vulnerability
–
CVE-2015-0309
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before…
–
CVE-2015-0308
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before…
–
CVE-2015-0307
Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X…