CVE-2014-0506

2014-03-2710:55:04

CWE-399

adobe

web.nvd.nist.gov

cve-2014-0506

adobe flash player

vulnerability

execute arbitrary code

sandbox protection

pwn2own

cansecwest 2014

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

7.5

Confidence

Low

EPSS

0.334

Percentile

97.1%

JSON

Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Adobe AIR before 13.0.0.83 on Android, Adobe AIR SDK before 13.0.0.83, and Adobe AIR SDK & Compiler before 13.0.0.83 allows remote attackers to execute arbitrary code, and possibly bypass an Internet Explorer sandbox protection mechanism, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2014.

Affected configurations

Nvd

Node

adobeflash_playerMatch12.0.0.77

AND

microsoftwindows

VendorProductVersionCPE
adobeflash_player12.0.0.77cpe:2.3:a:adobe:flash_player:12.0.0.77:*:*:*:*:*:*:*
microsoftwindows*cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*