Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

Versions of Adobe AIR prior to 15.0.0.293 are unpatched for the following vulnerabilities :

 - Multiple memory corruption issues due to improperly sanitized user-supplied input allow arbitrary code execution. (CVE-2014-0564, CVE-2014-0558)
 - An integer overflow issue due to improperly sanitized user-supplied input that allows arbitrary code execution. (CVE-2014-0569)
 - An arbitrary code execution vulnerability due to the handling of a dereferenced memory pointer. (CVE-2014-8439)

Versions of Adobe Flash player prior to 11.7.700.275 / 13.0.0.182 are outdated and thus unpatched for the following vulnerabilities :

  - Multiple memory corruption issues due to improperly sanitized user-supplied input allow arbitrary code execution. (CVE-2014-0564, CVE-2014-0558)
 - An integer overflow issue due to improperly sanitized user-supplied input that allows arbitrary code execution. (CVE-2014-0569)
  - An arbitrary code execution vulnerability due to the handling of a dereferenced memory pointer. (CVE-2014-8439)

According to its version number, the instance of Flash Player on the remote host is exposed to an arbitrary code execution vulnerability by means of a malicious SWF file. This vulnerability exists due to the processing of a dereferenced memory pointer when handling SWF files. 

Versions of Adobe Flash player equal or prior to 15.0.0.242 are outdated and thus unpatched for the following vulnerabilities :

  - A security bypass vulnerability that allows an attacker to bypass the same-origin policy (CVE-2014-0580).
  - Multiple memory corruption vulnerabilities that allow an attacker to execute arbitrary code (CVE-2014-0587, CVE-2014-9164).
  - A use-after-free vulnerability that can result in arbitrary code execution (CVE-2014-8443).
  - An unspecified information disclosure vulnerability (CVE-2014-9162).
  - A stack-based buffer overflow vulnerability that can be exploited to execute arbitrary code or elevate privileges (CVE-2014-9163).

Versions of Flash player earlier than 16.0.0.235 are unpatched for the following vulnerabilities:

  - A security bypass vulnerability that allows an attacker to bypass the same-origin policy. (CVE-2014-0580)

  - Multiple memory corruption vulnerabilities that allow an attacker to execute arbitrary code. (CVE-2014-0587, CVE-2014-9164)

  - A use-after-free vulnerability that can result in arbitrary code execution. (CVE-2014-8443)

  - An unspecified information disclosure vulnerability. (CVE-2014-9162)

  - A stack-based buffer overflow vulnerability that can be exploited to execute arbitrary code or elevate privileges. (CVE-2014-9163)

The remote host is affected by the vulnerability described in GLSA-201412-07 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

flash-player was updated to fix one security issue.

This security issue was fixed :

  - Hardening against a code execution flaw (CVE-2014-8439).

The following vulnerability is fixed with this update :

  - hardening against a remote code execution flaw     (APSB14-26). (bnc#907257)

An updated Adobe Flash Player package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6 Supplementary.

Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

This update fixes one vulnerability in Adobe Flash Player. This vulnerability is detailed in the Adobe Security Bulletin APSB14-26, listed in the References section.

A flaw was found in the way flash-plugin displayed certain SWF content. An attacker could use this flaw to create a specially crafted SWF file that would cause flash-plugin to crash or, potentially, execute arbitrary code when the victim loaded a page containing the malicious SWF content. (CVE-2014-8439)

All users of Adobe Flash Player should install this updated package, which upgrades Flash Player to version 11.2.202.424.

The version of Google Chrome installed on the remote Mac OS X host is prior to 39.0.2171.71. It is, therefore, affected by a remote code execution vulnerability in the included Flash Player plugin, which is due to the processing of a dereferenced memory pointer.

The version of Google Chrome installed on the remote Windows host is prior to 39.0.2171.71. It is, therefore, affected by a remote code execution vulnerability in the included Flash Player plugin, which is due to the processing of a dereferenced memory pointer.

The remote host is missing KB3018943. It is, therefore, affected by a remote code execution vulnerability in Adobe Flash Player due to the processing of a dereferenced memory pointer.

According to its version, the installation of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to 15.0.0.223.
It is, therefore, affected by a remote code execution vulnerability due to the processing of a dereferenced memory pointer.

According to its version, the installation of Adobe Flash Player installed on the remote Windows host is equal or prior to 15.0.0.223.
It is, therefore, affected by a remote code execution vulnerability due to the processing of a dereferenced memory pointer.

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 38.0.2125.104. It is, therefore, affected by the following vulnerabilities due to the version of Adobe Flash bundled with the application :

  - Multiple memory corruption issues due to improperly     sanitized user-supplied input allow arbitrary code     execution. (CVE-2014-0564, CVE-2014-0558)

  - An integer overflow issue due to improperly sanitized     user-supplied input that allows arbitrary code     execution. (CVE-2014-0569)

  - An arbitrary code execution vulnerability due to the     handling of a dereferenced memory pointer.
    (CVE-2014-8439)

The version of Google Chrome installed on the remote host is a version prior to 38.0.2125.104. It is, therefore, affected by the following vulnerabilities due to the version of Adobe Flash bundled with the application :

  - Multiple memory corruption issues due to improperly     sanitized user-supplied input allow arbitrary code     execution. (CVE-2014-0564, CVE-2014-0558)

  - An integer overflow issue due to improperly sanitized     user-supplied input that allows arbitrary code     execution. (CVE-2014-0569)

  - An arbitrary code execution vulnerability due to the     handling of a dereferenced memory pointer.
    (CVE-2014-8439)

The remote host is missing KB3001237. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues due to improperly     sanitized user-supplied input allow arbitrary code     execution. (CVE-2014-0564, CVE-2014-0558)

  - An integer overflow issue due to improperly sanitized     user-supplied input that allows arbitrary code     execution. (CVE-2014-0569)

  - An arbitrary code execution vulnerability due to the     handling of a dereferenced memory pointer.
    (CVE-2014-8439)

According to its version, the installation of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to 15.0.0.167.
It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues due to improperly     sanitized user-supplied input allow arbitrary code     execution. (CVE-2014-0564, CVE-2014-0558)

  - An integer overflow issue due to improperly sanitized     user-supplied input that allows arbitrary code     execution. (CVE-2014-0569)

  - An arbitrary code execution vulnerability due to the     handling of a dereferenced memory pointer.
    (CVE-2014-8439)

According to its version, the installation of Adobe AIR on the remote Mac OS X host is equal or prior to 15.0.0.249. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues due to improperly     sanitized user-supplied input allow arbitrary code     execution. (CVE-2014-0564, CVE-2014-0558)

  - An integer overflow issue due to improperly sanitized     user-supplied input that allows arbitrary code     execution. (CVE-2014-0569)

  - An arbitrary code execution vulnerability due to the     handling of a dereferenced memory pointer.
    (CVE-2014-8439)

According to its version, the installation of Adobe Flash Player installed on the remote Windows host is equal or prior to 15.0.0.167.
It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues due to improperly     sanitized user-supplied input allow arbitrary code     execution. (CVE-2014-0564, CVE-2014-0558)

  - An integer overflow issue due to improperly sanitized     user-supplied input that allows arbitrary code     execution. (CVE-2014-0569)

  - An arbitrary code execution vulnerability due to the     handling of a dereferenced memory pointer.
    (CVE-2014-8439)

According to its version, the installation of Adobe AIR on the remote Windows host is equal or prior to 15.0.0.249. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues due to improperly     sanitized user-supplied input allow arbitrary code     execution. (CVE-2014-0564, CVE-2014-0558)

  - An integer overflow issue due to improperly sanitized     user-supplied input that allows arbitrary code     execution. (CVE-2014-0569)

  - An arbitrary code execution vulnerability due to the     handling of a dereferenced memory pointer.
    (CVE-2014-8439)

ID	Name	Product	Family	Severity
8810	Adobe AIR < 15.0.0.293 Multiple Vulnerabilities (APSB14-22)	Nessus Network Monitor	Web Clients	high
8808	Flash Player < 13.0.0.250 / 15.0.0.167 Multiple Vulnerabilities (APSB14-22)	Nessus Network Monitor	Web Clients	high
8585	Flash Player <= 15.0.0.223 Dereferenced Memory Pointer RCE (APSB14-26)	Nessus Network Monitor	Web Clients	high
8604	Flash Player < 15.0.0.243 (inferred) Multiple Vulnerabilities (APSB14-27)	Nessus Network Monitor	Web Clients	high
8603	Flash Player < 16.0.0.235 Multiple Vulnerabilities (APSB14-27)	Nessus Network Monitor	Web Clients	high
79960	GLSA-201412-07 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
79755	openSUSE Security Update : flash-player (openSUSE-SU-2014:1562-1)	Nessus	SuSE Local Security Checks	critical
79686	SuSE 11.3 Security Update : flash-player (SAT Patch Number 10023)	Nessus	SuSE Local Security Checks	critical
79597	RHEL 5 / 6 : flash-plugin (RHSA-2014:1915)	Nessus	Red Hat Local Security Checks	critical
79579	Google Chrome < 39.0.2171.71 Flash Player Remote Code Execution (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
79578	Google Chrome < 39.0.2171.71 Flash Player Remote Code Execution	Nessus	Windows	critical
79444	MS KB3018943: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer	Nessus	Windows	critical
79443	Flash Player For Mac <= 15.0.0.223 Dereferenced Memory Pointer RCE (APSB14-26)	Nessus	MacOS X Local Security Checks	critical
79442	Flash Player <= 15.0.0.223 Dereferenced Memory Pointer RCE (APSB14-26)	Nessus	Windows	critical
78476	Google Chrome < 38.0.2125.104 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
78475	Google Chrome < 38.0.2125.104 Multiple Vulnerabilities	Nessus	Windows	critical
78444	MS KB3001237: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer	Nessus	Windows	critical
78443	Flash Player for Mac <= 15.0.0.167 Multiple Vulnerabilities (APSB14-22)	Nessus	MacOS X Local Security Checks	critical
78442	Adobe AIR for Mac <= 15.0.0.249 Multiple Vulnerabilities (APSB14-21)	Nessus	MacOS X Local Security Checks	critical
78441	Flash Player <= 15.0.0.167 Multiple Vulnerabilities (APSB14-22)	Nessus	Windows	critical
78440	Adobe AIR <= AIR 15.0.0.249 Multiple Vulnerabilities (APSB14-22)	Nessus	Windows	critical

Detections

Analytics

CVE-2014-8439

critical

Tenable Plugins

high

high

high

high

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical