CVE-2014-0497
Adobe Flash Player: Integer Underflow Vulnerablity
As of , CVE-2014-0497 in Adobe Flash Player is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 17 September 2024
- US federal deadline
- 8 October 202421 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.97 on 17 September 2024EPSS on the day CISA listed it.
- Public exploit
- 1 Metasploit module and 1 Exploit-DB entry (1 verified)
- Fix
- Vendor advice: www.adobe.comLinks below, from CISA's entry.
What CISA says to do
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA's required action
What the flaw is
Adobe Flash Player contains an integer underflow vulnerability that allows a remote attacker to execute arbitrary code.
CISA's description
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
The CVE record's description, from adobe
- CVE published
- 5 February 2014
- Assigned by
- adobe
- CVSS
- 8.8 High (CVSS 3.1, from CISA-ADP)
- CWE-191
- Integer Underflow (Wrap or Wraparound)
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- no
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- Exploit-DB published an exploit (EDB-ID 33212).
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: Adobe Flash Player Integer Underflow Remote Code Executionexploit module, rank normal
- Exploit-DB: Adobe Flash Player - Integer Underflow Remote Code Execution (Metasploit)EDB-ID 33212, verified by Exploit-DB, 6 May 2014
Flash Player: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2010-1297Memory Corruption | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.83; verified Exploit-DB entry | 0.83 | ||
| CVE-2011-0609Unspecified | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.64; verified Exploit-DB entry | 0.64 | ||
| CVE-2012-0754Memory Corruption | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.91; verified Exploit-DB entry | 0.91 | ||
| CVE-2015-0311Remote Code Execution | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.86; verified Exploit-DB entry | 0.86 | ||
| CVE-2015-0313Use-After-Free | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.95; verified Exploit-DB entry | 0.95 | ||
| CVE-2015-3113Heap-Based Buffer Overflow | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| CVE-2015-5122Use-After-Free | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.94; verified Exploit-DB entry | 0.94 | ||
| CVE-2011-0611Remote Code Execution | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| CVE-2012-1535Arbitrary Code Execution | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.70; verified Exploit-DB entry | 0.70 | ||
| CVE-2015-3043Memory Corruption | Adobe Flash Player | Patch this weekMetasploit module; EPSS 0.74; verified Exploit-DB entry | 0.74 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org