5.4Orta
Google Chrome
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
8.8Yüksek
KEV
CVE-2014-0497Adobe Flash Player Integer Underflow Vulnerablity
Aktif olarak istismar ediliyor — Adobe Flash Player Integer Underflow Vulnerablity
CISA bu açığın gerçek saldırılarda kullanıldığını 17.09.2024 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 08.10.2024.
Gerekli işlem: The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product. https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq ; https://nvd.nist.gov/vuln/detail/CVE-2014-0497
Açıklama
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
Zayıflık türü (CWE):
CWE-191
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| adobe | flash_player | < 11.7.700.261, 12.0.0 – ≤ 12.0.0.44 | |
| chrome | < 32.0.1700.107 | ||
| opensuse | opensuse | 11.4 | |
| redhat | enterprise linux desktop | 5.0 | |
| redhat | enterprise linux eus | 6.5 | |
| redhat | enterprise linux server | 5.0 | |
| redhat | enterprise linux server aus | 6.5 | |
| redhat | enterprise linux workstation | 5.0 | |
| suse | linux enterprise desktop | 11 |
Kaynaklar ve yamalar
- 33212 exploitThird Party AdvisoryVDB Entry
- http://helpx.adobe.com/security/products/flash-player/apsb14-04.html Broken LinkPatchVendor Advisory
- http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html Release Notes
- SUSE-SU-2014:0221 vendor-advisoryMailing List
- RHSA-2014:0137 vendor-advisoryThird Party Advisory
- 102849 vdb-entryBroken Link
- 65327 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 56799 third-party-advisoryBroken LinkThird Party Advisory
- 1029715 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 56737 third-party-advisoryBroken LinkThird Party Advisory
- 56437 third-party-advisoryBroken LinkThird Party Advisory
- openSUSE-SU-2014:0203 vendor-advisoryMailing List
- 56780 third-party-advisoryBroken LinkThird Party Advisory
- openSUSE-SU-2014:0197 vendor-advisoryMailing List
- 56839 third-party-advisoryBroken LinkThird Party Advisory
- adobe-flash-cve20140497-code-exec(90884) vdb-entryThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0497 US Government Resource
CPE eşleşmeleri (NVD) (17)
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*< 11.2.202.336cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*< 11.7.700.261cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*≥ 11.8.800.94 < 12.0.0.44cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*< 32.0.1700.107cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*