CVE-2014-8439highunder attackCWE-416

CVE-2014-8439

Published · Updated

Follow this CVE+ Monitor Flash Player

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 20%
from disclosure to weapon
Published on NVDNov 25
CISA KEV+2738d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
6 products
Red Hat Enterprise Linux Desktop Supplementary (v. 5) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux HPC Node Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · and others 1
fix ↗
Action required by CISAfederal deadline: 2022-06-15

The impacted product is end-of-life and should be disconnected if still in use.

In short

Adobe Flash Player and Adobe AIR contain a memory flaw that allows attackers to run arbitrary code or crash the application by sending specially crafted data. This is a critical vulnerability affecting millions of users.

Technical detail

Use-after-free vulnerability (CWE-416) in Adobe Flash Player, AIR, and related SDKs across Windows, OS X, and Linux platforms. Attack vector involves sending malicious input that triggers invalid pointer dereference; no authentication required. Successful exploitation enables remote code execution or denial of service.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a