CVSS: 10.0EPSS: 97%CPEs: 63EXPL: 1CVE-2014-0556 – Adobe Flash Player - copyPixelsToByteArray Integer Overflow
https://notcve.org/view.php?id=CVE-2014-0556
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0559. Desbordamiento de buffer basado en memoria dinámica en Adobe Flash Player anterior a 13.0.0.244 y 14.x y 15.x anterior a 15.0.0.152 en Windows y6 OS X y anterior a 11.2.202.406 en Linux, Adobe AIR anterior a 15.0.0.249 en Windows y OS X y anterior a 15.0.0.252 en Android, Adobe AIR SDK anteriora 15.0.0.249, y Adobe AIR SDK & Compiler anterior a 15.0.0.249 permite a atacantes ejecutar código arbitrario a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-0559. • https://www.exploit-db.com/exploits/36808 http://googleprojectzero.blogspot.com/2014/09/exploiting-cve-2014-0556-in-flash.html http://helpx.adobe.com/security/products/flash-player/apsb14-21.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00021.html http://packetstormsecurity.com/files/131516/Adobe-Flash-Player-copyPixelsToByteArray-Integer- • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 5%CPEs: 63EXPL: 0CVE-2014-0559 – flash-plugin: multiple code execution or security bypass flaws (APSB14-21)
https://notcve.org/view.php?id=CVE-2014-0559
Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x before 15.0.0.152 on Windows and OS X and before 11.2.202.406 on Linux, Adobe AIR before 15.0.0.249 on Windows and OS X and before 15.0.0.252 on Android, Adobe AIR SDK before 15.0.0.249, and Adobe AIR SDK & Compiler before 15.0.0.249 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0556. Desbordamiento de buffer basado en memoria dinámica en Adobe Flash Player anterior a 13.0.0.244 y 14.x y 15.x anterior a 15.0.0.152 en Windows y6 OS X y anterior a 11.2.202.406 en Linux, Adobe AIR anterior a 15.0.0.249 en Windows y OS X y anterior a 15.0.0.252 en Android, Adobe AIR SDK anteriora 15.0.0.249, y Adobe AIR SDK & Compiler anterior a 15.0.0.249 permite a atacantes ejecutar código arbitrario a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-0556. • http://helpx.adobe.com/security/products/flash-player/apsb14-21.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00016.html http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00021.html http://secunia.com/advisories/61089 http://security.gentoo.org/glsa/glsa-201409-05.xml http://www.securityfocus.com/bid/69704 http://www.securitytracker.com/id/1030822 https://exchange.xforce.ibmcloud • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 54EXPL: 0CVE-2014-5333 – flash-plugin: multiple code execution or security bypass flaws (APSB14-18)
https://notcve.org/view.php?id=CVE-2014-5333
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671. Adobe Flash Player en versiones anteriores a 13.0.0.241 y 14.x en versiones anteriores a 14.0.0.176 en Windows y OS X y en versiones anteriores a 11.2.202.400 en Linux, Adobe AIR en versiones anteriores a 14.0.0.178 en Windows y OS X y en versiones anteriores a 14.0.0.179 en Android, Adobe AIR SDK en versiones anteriores a 14.0.0.178 y Adobe AIR SDK & Compiler en versiones anteriores a 14.0.0.178 no restringe adecuadamente el formato de archivo SWF, lo que permite a atacantes remotos llevar a cabo ataques de CSRF contra puntos finales JSONP y obtener información sensible, a través de un elemento OBJECT manipulado con contenido SWF que satisface los requerimientos de set de caractéres de una llamada de retorno API, en conjunto con una manipulación que involucra un caracter '$' (signo de dolar) o '(' (paréntesis abierto). NOTA: este problema existe por un arreglo incompleto para CVE-2014-4671. • http://helpx.adobe.com/security/products/flash-player/apsb14-18.html http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today https://exchange.xforce.ibmcloud.com/vulnerabilities/95418 https://access.redhat.com/security/cve/CVE-2014-5333 https://bugzilla.redhat.com/show_bug.cgi?id=1129417 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 1%CPEs: 54EXPL: 0CVE-2014-0544 – flash-plugin: multiple code execution or security bypass flaws (APSB14-18)
https://notcve.org/view.php?id=CVE-2014-0544
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, and CVE-2014-0545. Adobe Flash Player anterior a 13.0.0.241 y 14.x anterior a 14.0.0.176 en Windows y OS X y anterior a 11.2.202.400 en Linux, Adobe AIR anterior a 14.0.0.178 en Windows y OS X y anterior a 14.0.0.179 en Android, Adobe AIR SDK anterior a 14.0.0.178, y Adobe AIR SDK & Compiler anterior a 14.0.0.178 no restringen debidamente el descubrimiento de las direcciones de la memoria, lo que permite a atacantes evadir el mecanismo de protección ASLR a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-0540, CVE-2014-0542, CVE-2014-0543, y CVE-2014-0545. • http://helpx.adobe.com/security/products/flash-player/apsb14-18.html http://secunia.com/advisories/60710 http://secunia.com/advisories/60732 http://security.gentoo.org/glsa/glsa-201408-05.xml http://www.securitytracker.com/id/1030712 https://access.redhat.com/security/cve/CVE-2014-0544 https://bugzilla.redhat.com/show_bug.cgi?id=1129417 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 10.0EPSS: 1%CPEs: 54EXPL: 0CVE-2014-0542 – flash-plugin: multiple code execution or security bypass flaws (APSB14-18)
https://notcve.org/view.php?id=CVE-2014-0542
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0540, CVE-2014-0543, CVE-2014-0544, and CVE-2014-0545. Adobe Flash Player anterior a 13.0.0.241 y 14.x anterior a 14.0.0.176 en Windows y OS X y anterior a 11.2.202.400 en Linux, Adobe AIR anterior a 14.0.0.178 en Windows y OS X y anterior a 14.0.0.179 en Android, Adobe AIR SDK anterior a 14.0.0.178, y Adobe AIR SDK & Compiler anterior a 14.0.0.178 no restringen debidamente el descubrimiento de las direcciones de memoria, lo que permite a atacantes evadir el mecanismo de protección ASLR a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-0540, CVE-2014-0543, CVE-2014-0544, y CVE-2014-0545. • http://helpx.adobe.com/security/products/flash-player/apsb14-18.html http://secunia.com/advisories/60710 http://secunia.com/advisories/60732 http://security.gentoo.org/glsa/glsa-201408-05.xml http://www.securitytracker.com/id/1030712 https://access.redhat.com/security/cve/CVE-2014-0542 https://bugzilla.redhat.com/show_bug.cgi?id=1129417 • CWE-264: Permissions, Privileges, and Access Controls •