CVE-2014-0499

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 do not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.

Metrics

CVSS 2.0 7.8/10AV:N/AC:L/Au:N/C:C/I:N/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://helpx.adobe.com/security/products/flash-player/apsb14-07.htmlPatch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0196.htmlThird Party Advisory
http://security.gentoo.org/glsa/glsa-201405-04.xmlThird Party Advisory
http://helpx.adobe.com/security/products/flash-player/apsb14-07.htmlPatch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.htmlMailing List, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0196.htmlThird Party Advisory
http://security.gentoo.org/glsa/glsa-201405-04.xmlThird Party Advisory

Timeline

Published: Feb 21, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-050010.0Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) CVE-2014-050110.0Adobe Shockwave Player before 12.0.9.149 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) CVE-2014-05028.8Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and b CVE-2014-05036.4Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, all CVE-2014-05045.0Adobe Flash Player before 11.7.700.272 and 11.8.x through 12.0.x before 12.0.0.77 on Windows and OS X, and before 11.2.202.346 on Linux, all CVE-2014-050510.0Adobe Shockwave Player before 12.1.0.150 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) CVE-2014-050610.0Use-after-free vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and b CVE-2014-05079.3Buffer overflow in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.20 CVE-2014-05085.0Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows and OS X and before 11.2.202.350 on Linux, Ado CVE-2014-05094.3Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 11.7.700.275 and 11.8.x through 13.0.x before 13.0.0.182 on Windows an CVE-2014-051010.0Heap-based buffer overflow in Adobe Flash Player 12.0.0.77 allows remote attackers to execute arbitrary code and bypass a sandbox protection CVE-2014-051110.0Heap-based buffer overflow in Adobe Reader 11.0.06 allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrate