4.7Mittel
Google Chrome
Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
8.8Hoch
KEV
CVE-2014-0497Adobe Flash Player Integer Underflow Vulnerablity
Bekannt ausgenutzt — Adobe Flash Player Integer Underflow Vulnerablity
CISA hat am 17.09.2024 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 08.10.2024.
Erforderliche Maßnahme: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq ; https://nvd.nist.gov/vuln/detail/CVE-2014-0497
Beschreibung
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
Schwachstellentyp (CWE):
CWE-191
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| adobe | flash_player | < 11.7.700.261, 12.0.0 – ≤ 12.0.0.44 | |
| chrome | < 32.0.1700.107 | ||
| opensuse | opensuse | 11.4 | |
| redhat | enterprise linux desktop | 5.0 | |
| redhat | enterprise linux eus | 6.5 | |
| redhat | enterprise linux server | 5.0 | |
| redhat | enterprise linux server aus | 6.5 | |
| redhat | enterprise linux workstation | 5.0 | |
| suse | linux enterprise desktop | 11 |
Referenzen und Patches
- 33212 exploitThird Party AdvisoryVDB Entry
- http://helpx.adobe.com/security/products/flash-player/apsb14-04.html Broken LinkPatchVendor Advisory
- http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html Release Notes
- SUSE-SU-2014:0221 vendor-advisoryMailing List
- RHSA-2014:0137 vendor-advisoryThird Party Advisory
- 102849 vdb-entryBroken Link
- 65327 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 56799 third-party-advisoryBroken LinkThird Party Advisory
- 1029715 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 56737 third-party-advisoryBroken LinkThird Party Advisory
- 56437 third-party-advisoryBroken LinkThird Party Advisory
- openSUSE-SU-2014:0203 vendor-advisoryMailing List
- 56780 third-party-advisoryBroken LinkThird Party Advisory
- openSUSE-SU-2014:0197 vendor-advisoryMailing List
- 56839 third-party-advisoryBroken LinkThird Party Advisory
- adobe-flash-cve20140497-code-exec(90884) vdb-entryThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0497 US Government Resource
CPE-Treffer (NVD) (17)
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*< 11.2.202.336cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*< 11.7.700.261cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*≥ 11.8.800.94 < 12.0.0.44cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*< 32.0.1700.107cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*