7.8High
KEV
CVE-2014-9163Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
Known exploited — Adobe Flash Player Stack-Based Buffer Overflow Vulnerability
CISA confirmed this vulnerability is used in real attacks on 13.04.2022. Remediation deadline for US federal agencies: 04.05.2022.
Required action: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2014-9163
Description
Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.
Weakness (CWE):
CWE-121
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| adobe | flash player | 13.0 – < 13.0.0.259 |
References and patches
- http://helpx.adobe.com/security/products/flash-player/apsb14-27.html Vendor Advisory
- https://github.com/cisagov/vulnrichment/issues/196 Issue Tracking
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-9163 US Government Resource
CPE matches (NVD) (4)
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*≥ 13.0 < 13.0.0.259cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*≥ 14.0 ≤ 14.0.0.179cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*≥ 15.0 < 15.0.0.246cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*≥ 11.0 < 11.2.202.425