Flash Player < 14.0.0.176 Multiple Vulnerabilities (APSB14-18)

Critical Nessus Network Monitor Plugin ID 8357

Synopsis

The remote host has a browser plugin that is affected by multiple vulnerabilities.

Description

Versions of Flash player earlier than 14.0.0.176 are unpatched for vulnerabilities related to the flash-plugin's processing of certain SWF content. An attacker could use these flaws to create a specially crafted SWF file that would cause flash-plugin to crash or potentially execute arbitrary code when the SWF content is loaded. (CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545)

Solution

Upgrade to 14.0.0.176 or later.

See Also

http://helpx.adobe.com/security/products/flash-player/apsb14-18.html

http://www.scmagazine.com/adobe-addresses-three-vulnerabilities-flash-player-deemed-critical/article/359931/

http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/

Plugin Details

Severity: Critical

ID: 8357

Family: Web Clients

Published: 2014/08/20

Modified: 2016/01/19

Dependencies: 5158

Nessus ID: 77193

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

CVSSv3

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:flash_player

Patch Publication Date: 2014/08/12

Vulnerability Publication Date: 2014/08/12

Reference Information

CVE: CVE-2014-5333, CVE-2014-0538, CVE-2014-0540, CVE-2014-0541, CVE-2014-0542, CVE-2014-0543, CVE-2014-0544, CVE-2014-0545

BID: 69320, 69197, 69196, 69195, 69194, 69192, 69191, 69190, 68457