cyfenced.com →

[ CVE-2014-8439 · Published 25 Nov 2014 ]

Adobe Flash Player Dereferenced Pointer Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 20%No fix listed yet

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-05-25
  • EPSS: 20% chance of exploitation in the next 30 days (higher than 97% of CVEs)

[ Description ]Official description

Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allow attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.

CISA: Adobe Flash Player has a vulnerability in the way it handles a dereferenced memory pointer which could lead to code execution.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Jun 2022): The impacted product is end-of-life and should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References