Adobe Flash Player Double Free Vulnerablity

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2024-09-17
• EPSS: 25% chance of exploitation in the next 30 days (higher than 98% of CVEs)

[ Description ]Official description

Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

CISA: Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 8 Oct 2024): The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.

• Patch on helpx.adobe.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• helpx.adobe.com/security/products/flash-player/apsb14-07.htmlBroken LinkPatchVendor Advisory
• lists.opensuse.org/opensuse-security-announce/2014-02/msg00014.htmlMailing List
• lists.opensuse.org/opensuse-security-announce/2014-02/msg00015.htmlMailing List
• lists.opensuse.org/opensuse-security-announce/2014-02/msg00017.htmlMailing List
• rhn.redhat.com/errata/RHSA-2014-0196.htmlThird Party Advisory
• security.gentoo.org/glsa/glsa-201405-04.xmlThird Party Advisory
• www.alienvault.com/open-threat-exchange/blog/analysis-of-an-attack-exploiting-the-adobe…ExploitThird Party Advisory
• volatility-labs.blogspot.com/2014/04/building-decoder-for-cve-2014-0502.htmlExploitThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource