CVE-2014-0497

critical-risk
Published 2014-02-05

Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

Do I need to act?

!
93.1% chance of exploitation in next 30 days
EPSS score — higher than 7% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
1 public exploit available
33212
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (15)

Affected Vendors

Suse Google Opensuse Redhat Adobe

References (33)

Release Notes http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html
Broken Link http://helpx.adobe.com/security/products/flash-player/apsb14-04.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00000.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00001.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2014-0137.html
Broken Link http://secunia.com/advisories/56437
Broken Link http://secunia.com/advisories/56737
Broken Link http://secunia.com/advisories/56780
Broken Link http://secunia.com/advisories/56799
Broken Link http://secunia.com/advisories/56839
Third Party Advisory http://www.exploit-db.com/exploits/33212
Broken Link http://www.osvdb.org/102849
Broken Link http://www.securityfocus.com/bid/65327
Broken Link http://www.securitytracker.com/id/1029715
Third Party Advisory https://exchange.xforce.ibmcloud.com/vulnerabilities/90884
Release Notes http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html
Broken Link http://helpx.adobe.com/security/products/flash-player/apsb14-04.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00000.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00001.html
and 13 more references
84
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 34/34 · Critical
Exposure 18/34 · Moderate