CVE-2014-0502

High · 8.8 CISA KEV

CVSS

8.8

EPSS

24.8%

Published

Feb 21, 2014

CISA due date

Oct 8, 2024

The record

Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

Affected packages

Ecosystem	Package	Fixed
Mageia:3	flash-player-plugin	11.2.202.341-1.mga3.nonfree
Mageia:4	flash-player-plugin	11.2.202.341-1.mga4.nonfree
Red Hat:rhel_extras:5::client	flash-plugin	0:11.2.202.341-1.el5
Red Hat:rhel_extras:5::server	flash-plugin	0:11.2.202.341-1.el5
Red Hat:rhel_extras:6	flash-plugin	0:11.2.202.341-1.el6

Related vulnerabilities

CVE-2014-8439 Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and… Also affects flash-player-plugin
CVE-2014-0582 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.252 and 14.x and 15.x… Also affects flash-player-plugin
CVE-2014-8440 Adobe Flash Player before 13.0.0.252 and 14.x and 15.x before 15.0.0.223 on Windows and… Also affects flash-player-plugin
CVE-2014-0569 Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before… Also affects flash-player-plugin
CVE-2014-0559 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x… Also affects flash-player-plugin
CVE-2014-0556 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x… Also affects flash-player-plugin
CVE-2014-4671 Adobe Flash Player before 13.0.0.231 and 14.x before 14.0.0.145 on Windows and OS X and… Also affects flash-player-plugin
CVE-2014-0536 Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and… Also affects flash-player-plugin