CVE-2014-5333: CSRF

First published: Tue Aug 19 2014(Updated: )

Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.

Credit: psirt@adobe.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/weakness
• agent/references
• agent/severity
• agent/author
• agent/type
• agent/event
• agent/description
• agent/first-publish-date
• agent/softwarecombine
• agent/last-modified-date
• agent/remedy
• agent/tags
• collector/nvd-index
• agent/software-canonical-lookup-request
• collector/mitre-cve
• source/MITRE
• vendor/adobe
• canonical/adobe adobe air
• version/adobe adobe air/14.0.0.137
• version/adobe adobe air/13.0.0.83
• version/adobe adobe air/13.0.0.111
• version/adobe adobe air/14.0.0.110
• vendor/google
• canonical/google android
• canonical/adobe flash player
• version/adobe flash player/13.0.0.231
• version/adobe flash player/13.0.0.182
• version/adobe flash player/13.0.0.201
• version/adobe flash player/13.0.0.206
• version/adobe flash player/13.0.0.214
• version/adobe flash player/13.0.0.223
• version/adobe flash player/14.0.0.125
• version/adobe flash player/14.0.0.145
• vendor/apple
• canonical/apple mac os x
• vendor/microsoft
• canonical/microsoft windows
• canonical/adobe adobe air sdk
• version/adobe adobe air sdk/14.0.0.137
• version/adobe adobe air sdk/13.0.0.83
• version/adobe adobe air sdk/13.0.0.111
• version/adobe adobe air sdk/14.0.0.110
• version/adobe flash player/11.2.202.394
• version/adobe flash player/11.2.202.223
• version/adobe flash player/11.2.202.228
• version/adobe flash player/11.2.202.233
• version/adobe flash player/11.2.202.235
• version/adobe flash player/11.2.202.236
• version/adobe flash player/11.2.202.238
• version/adobe flash player/11.2.202.243
• version/adobe flash player/11.2.202.251
• version/adobe flash player/11.2.202.258
• version/adobe flash player/11.2.202.261
• version/adobe flash player/11.2.202.262
• version/adobe flash player/11.2.202.270
• version/adobe flash player/11.2.202.273
• version/adobe flash player/11.2.202.275
• version/adobe flash player/11.2.202.280
• version/adobe flash player/11.2.202.285
• version/adobe flash player/11.2.202.291
• version/adobe flash player/11.2.202.297
• version/adobe flash player/11.2.202.310
• version/adobe flash player/11.2.202.332
• version/adobe flash player/11.2.202.335
• version/adobe flash player/11.2.202.336
• version/adobe flash player/11.2.202.341
• version/adobe flash player/11.2.202.346
• version/adobe flash player/11.2.202.350
• version/adobe flash player/11.2.202.356
• version/adobe flash player/11.2.202.359
• version/adobe flash player/11.2.202.378
• vendor/linux
• canonical/linux linux kernel