CVE-2014-0540

CWE-26410 documents6 sources

Severity

10.0CRITICAL

EPSS

1.2%

top 20.80%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Adobe Adobe AIR Adobe Adobe AIR SDK Adobe Flash Player

Timeline

PublishedAug 12

Latest updateMay 17

Description

Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict discovery of memory addresses, which allows attackers to bypass the ASLR protection mechanism via unspecified vectors, a different vulnerability than CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, …

CVSS vector

AV:N/AC:L/C:C/I:C/A:CExploitability: 10.0 | Impact: 10.0

Affected Packages3 packages

▶NVDadobe/flash_player13.0.0.231+36

▶NVDadobe/adobe_air14.0.0.137+4

▶NVDadobe/adobe_air_sdk14.0.0.137+3

Patches

Patch: helpx.adobe.com ↗Patch: helpx.adobe.com ↗

🔴Vulnerability Details

GHSA

GHSA-2j7g-j9qp-627h: Adobe Flash Player before 13↗2022-05-17

▶

CVEList

CVE-2014-0540: Adobe Flash Player before 13↗2014-08-12

▶

Project0

What does a pointer look like, anyway? - Project Zero↗2014-08-01

▶