CVE-2014-0569: adobe air_desktop_runtime Integer Overflow or Wraparound

CVSS: 9.3v2.0HighModified

AliasesUBUNTU-CVE-2014-0569

Published 15-10-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-0569 is a high (CVSS 9.3) Integer Overflow or Wraparound vulnerability in adobe air_desktop_runtime. EPSS estimates a 91.28% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

91.28%

0%100%

Critical · -0.05 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 2

MGASA-2014-0448 RHSA-2014:1648

Timeline

15-10-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adobe AIR SDK before 15.0.0.302, and Adobe AIR SDK & Compiler before 15.0.0.302 allows attackers to execute arbitrary code via unspecified vectors.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

91.28%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.05 pp

From 91.33% on 19-09-2026

19-09-202619-10-2026

EPSS score

91.28%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

exploit-databaseremotewindowsVerified
Adobe Flash Player - casi32 Integer Overflow (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
Adobe Flash Player casi32 Integer Overflow
exploit/windows/browser/adobe_flash_casi32_int_overflow
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Affected systems

Adobe4 products

air_desktop_runtime≤ 15.0.0.249
air_sdk≤ 15.0.0.249 | ≤ 15.0.0.252
flash_player≤ 11.2.202.406 | ≤ 13.0.0.244 | ≤ 15.0.0.152 | ≤ 15.0.0.167
flash_player_desktop_runtime≤ 15.0.0.167

Opensuse2 products

evergreen11.4
opensuseEOL12.3 | 13.1

Suse1 product

linux_enterprise_desktop11:sp3

Ubuntu1 product

flashplugin-nonfree< 11.2.202.411ubuntu0.14.04.1

4 vendors · 8 products

References

11 links

lists.opensuse.org/opensuse-updates/2014-10/msg00033.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.securityfocus.com/bid/70441VDB EntryX Refsource BIDThird Party Advisory
secunia.com/advisories/61980Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2014-11/msg00002.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
rhn.redhat.com/errata/RHSA-2014-1648.htmlVendor AdvisoryX Refsource REDHATBroken Link
www.securitytracker.com/id/1031019VDB EntryX Refsource SECTRACKThird Party Advisory
www.zerodayinitiative.com/advisories/ZDI-14-365/X Refsource MISCThird Party AdvisoryVDB Entry
helpx.adobe.com/security/products/flash-player/apsb14-22.htmlX Refsource CONFIRMPatchVendor AdvisoryREPORT
lists.opensuse.org/opensuse-security-announce/2015-04/msg00013.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
ubuntu.com/security/CVE-2014-0569REPORT

Show all 11 references

www.cve.org/CVERecord?id=CVE-2014-0569REPORT

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities