CVE-2014-0502: Adobe Flash Player Double Free Vulnerablity
Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.
Other sources
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Discontinue utilization of Adobe Flash Player and impacted Adobe AIR/AIR SDK/AIR SDK & Compiler versions because the affected product is end-of-life (EoL) and/or end-of-service (EoS).
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0502?
CVE-2014-0502 has a critical severity rating as it allows a remote attacker to execute arbitrary code.
How do I fix CVE-2014-0502?
To fix CVE-2014-0502, users should update Adobe Flash Player to version 11.7.700.269 or later.
Which versions of Adobe Flash Player are affected by CVE-2014-0502?
Adobe Flash Player versions prior to 11.7.700.269 on Windows and Mac OS X and 11.2.202.341 on Linux are affected by CVE-2014-0502.
Can CVE-2014-0502 be exploited on all operating systems?
CVE-2014-0502 primarily affects Adobe Flash Player on Windows and Mac OS X, with some Linux versions also vulnerable.
Is Adobe AIR affected by CVE-2014-0502?
Yes, versions of Adobe AIR prior to 4.0.0.1628 are also affected by CVE-2014-0502.