CVE-2014-0497 Adobe Flash Player Integer Underflow Vulnerablity
Remote attackers can execute arbitrary code via an integer underflow vulnerability in Adobe Flash Player.
- Exploited in the wild
- Since 17 Sep 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2014-0497?
CVE-2014-0497 is a high-severity vulnerability in Adobe Flash Player, published on 5 Feb 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
Weakness: CWE-191
Which versions are affected by CVE-2014-0497?
It affects 9 products.
Linux distribution packages (3)
flash-plugin Red Hat:rhel_extras:5::client | All versions | 0:11.2.202.336-1.el5 |
flash-plugin Red Hat:rhel_extras:5::server | All versions | 0:11.2.202.336-1.el5 |
flash-plugin Red Hat:rhel_extras:6 | All versions | 0:11.2.202.336-1.el6 |
Products include Adobe Flash Player, Google Chrome, Opensuse Opensuse, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server and 3 more.
How do I fix CVE-2014-0497?
Upgrade to a fixed version. US federal agencies must fix it by 8 Oct 2024.
Is CVE-2014-0497 being exploited?
Yes. Attackers have exploited CVE-2014-0497 in the wild since at least 17 Sep 2024.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as GHSA-qx9j-q623-p5fh, MGASA-2014-0035, RHSA-2014:0137.