// For flags

CVE-2014-0520

flash-plugin: security protection bypass (APSB14-14)

Severity Score

9.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Adobe Flash Player before 13.0.0.214 on Windows and OS X and before 11.2.202.359 on Linux, Adobe AIR SDK before 13.0.0.111, and Adobe AIR SDK & Compiler before 13.0.0.111 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0517, CVE-2014-0518, and CVE-2014-0519.

Adobe Flash Player anterior a 13.0.0.214 en Windows y OS X y anterior a 11.2.202.359 en Linux, Adobe AIR SDK anterior a 13.0.0.111 y Adobe AIR SDK & Compiler anterior a 13.0.0.111 permiten a atacantes evadir restricciones de acceso a través de vectores no especificados, una vulnerabilidad diferente a CVE-2014-0517, CVE-2014-0518 y CVE-2014-0519.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities are detailed in the Adobe Security Bulletin APSB14-14, listed in the References section. Multiple flaws were found in the way flash-plugin displayed certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2013-12-20 CVE Reserved
  • 2014-05-14 CVE Published
  • 2024-08-06 CVE Updated
  • 2025-04-12 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-264: Permissions, Privileges, and Access Controls
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Adobe
Search vendor "Adobe"
 Flash Player
Search vendor "Adobe" for product "Flash Player"
 >= 13.0 < 13.0.0.214
Search vendor "Adobe" for product "Flash Player" and version " >= 13.0 < 13.0.0.214"
-
Affected
in Apple
Search vendor "Apple"
 Mac Os X
Search vendor "Apple" for product "Mac Os X"
*-
Safe
Adobe
Search vendor "Adobe"
 Flash Player
Search vendor "Adobe" for product "Flash Player"
 >= 13.0 < 13.0.0.214
Search vendor "Adobe" for product "Flash Player" and version " >= 13.0 < 13.0.0.214"
-
Affected
in Microsoft
Search vendor "Microsoft"
 Windows
Search vendor "Microsoft" for product "Windows"
--
Safe
Adobe
Search vendor "Adobe"
 Flash Player
Search vendor "Adobe" for product "Flash Player"
 >= 11.0 < 11.2.202.359
Search vendor "Adobe" for product "Flash Player" and version " >= 11.0 < 11.2.202.359"
-
Affected
in Linux
Search vendor "Linux"
 Linux Kernel
Search vendor "Linux" for product "Linux Kernel"
*-
Safe
Adobe
Search vendor "Adobe"
 Adobe Air
Search vendor "Adobe" for product "Adobe Air"
 < 13.0.0.111
Search vendor "Adobe" for product "Adobe Air" and version " < 13.0.0.111"
-
Affected