CVE-2014-0497
Estado: AnalizadaCrítica (9.8)⚠ Explotación activa
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 100%
- Percentil entre todas las CVEs puntuadas: 100
- Fecha de la puntuación: 2/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
CISA KEV — explotada activamente
- Añadida al catálogo: 17/9/2024
- Plazo de remediación: 8/10/2024
- Uso conocido en ransomware: Unknown
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access95 % - Impacto principal
T1059Command and Scripting Interpreterexecution90 %
CVE crítico (CVSS 3.1 9.8) en Flash Player con AV:N/PR:N/UI:N; ejecución remota de código arbitrario sin autenticación es indicativo de T1190. Impacto confirmado por descripción de ejecución de código.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (9)
CWE
- CWE-191
- CWE-191
Referencias
- http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html
- http://helpx.adobe.com/security/products/flash-player/apsb14-04.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html
- http://rhn.redhat.com/errata/RHSA-2014-0137.html
- http://secunia.com/advisories/56437
- http://secunia.com/advisories/56737
- http://secunia.com/advisories/56780
- http://secunia.com/advisories/56799
- http://secunia.com/advisories/56839
- http://www.exploit-db.com/exploits/33212
- http://www.osvdb.org/102849
- http://www.securityfocus.com/bid/65327
- http://www.securitytracker.com/id/1029715
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90884
- http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html
- http://helpx.adobe.com/security/products/flash-player/apsb14-04.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html
- http://rhn.redhat.com/errata/RHSA-2014-0137.html
- http://secunia.com/advisories/56437
- http://secunia.com/advisories/56737
- http://secunia.com/advisories/56780
- http://secunia.com/advisories/56799
- http://secunia.com/advisories/56839
- http://www.exploit-db.com/exploits/33212
- http://www.osvdb.org/102849
- http://www.securityfocus.com/bid/65327
- http://www.securitytracker.com/id/1029715
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90884
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0497
JSON original (NVD)
Mostrar
{
"id": "CVE-2014-0497",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2014-0497",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2024-09-18T18:34:13.496174Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@adobe.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*"
],
"vendor": "adobe",
"product": "flash_player",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "11.7.700.261",
"versionType": "custom"
},
{
"status": "affected",
"version": "12.0.0",
"versionType": "custom",
"lessThanOrEqual": "12.0.0.44"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*"
],
"vendor": "adobe",
"product": "flash_player",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "11.7.700.261",
"versionType": "custom"
},
{
"status": "affected",
"version": "12.0.0",
"versionType": "custom",
"lessThanOrEqual": "12.0.0.44"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2014-02-05T05:15:29.897",
"references": [
{
"url": "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html",
"tags": [
"Release Notes"
],
"source": "psirt@adobe.com"
},
{
"url": "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html",
"tags": [
"Broken Link",
"Patch",
"Vendor Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00000.html",
"tags": [
"Mailing List"
],
"source": "psirt@adobe.com"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00001.html",
"tags": [
"Mailing List"
],
"source": "psirt@adobe.com"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html",
"tags": [
"Mailing List"
],
"source": "psirt@adobe.com"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2014-0137.html",
"tags": [
"Third Party Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "http://secunia.com/advisories/56437",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "http://secunia.com/advisories/56737",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "http://secunia.com/advisories/56780",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "http://secunia.com/advisories/56799",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "http://secunia.com/advisories/56839",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "psirt@adobe.com"
},
{
"url": "http://www.exploit-db.com/exploits/33212",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@adobe.com"
},
{
"url": "http://www.osvdb.org/102849",
"tags": [
"Broken Link"
],
"source": "psirt@adobe.com"
},
{
"url": "http://www.securityfocus.com/bid/65327",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@adobe.com"
},
{
"url": "http://www.securitytracker.com/id/1029715",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@adobe.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90884",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "psirt@adobe.com"
},
{
"url": "http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html",
"tags": [
"Release Notes"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://helpx.adobe.com/security/products/flash-player/apsb14-04.html",
"tags": [
"Broken Link",
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00000.html",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00001.html",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00006.html",
"tags": [
"Mailing List"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://rhn.redhat.com/errata/RHSA-2014-0137.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/56437",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/56737",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/56780",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/56799",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/56839",
"tags": [
"Broken Link",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.exploit-db.com/exploits/33212",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.osvdb.org/102849",
"tags": [
"Broken Link"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/65327",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1029715",
"tags": [
"Broken Link",
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90884",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0497",
"tags": [
"US Government Resource"
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-191"
}
]
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-191"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors."
},
{
"lang": "es",
"value": "Desbordamiento inferior de enteros en Adobe Flash Player anterior a 11.7.700.261 y 11.8.x hasta 12.0.x anterior a 12.0.0.44 en Windows y Mac OS X, y anterior a 11.2.202.336 en Linux, permite a atacantes remotos ejecutar código arbitrario a través de vectores no especificados."
}
],
"lastModified": "2026-06-17T00:03:09.170",
"cisaActionDue": "2024-10-08",
"cisaExploitAdd": "2024-09-17",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0FFB96CE-2C20-471A-BA61-36909F36400F",
"versionEndExcluding": "11.2.202.336"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "155AD4FB-E527-4103-BCEF-801B653DEA37"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D00F33E5-B1D9-4D70-9BA7-994BB84A423D",
"versionEndExcluding": "11.7.700.261"
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53CBCC27-0B1B-4DAA-990E-A724720C3C58",
"versionEndExcluding": "12.0.0.44",
"versionStartIncluding": "11.8.800.94"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0FF5999A-9D12-4CDD-8DE9-A89C10B2D574"
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D956DCBD-B205-4A80-A8C5-82C186F50DEF",
"versionEndExcluding": "32.0.1700.107"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
},
{
"criteria": "cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D32ACF6F-5FF7-4815-8EAD-4719F5FC9B79"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "133AAFA7-AF42-4D7B-8822-AA2E85611BF5"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE249E1B-A1FD-4E08-AA71-A0E1F10FFE97"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_eus:6.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "569964DA-31BE-4520-A66D-C3B09D557AB8"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "54D669D4-6D7E-449D-80C1-28FA44F06FFE"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9BBCD86A-E6C7-4444-9D74-F861084090F0"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server_aus:6.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F3BEFDB-5156-4E1C-80BB-8BE9FEAA7623"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D0AC5CD5-6E58-433C-9EB3-6DFE5656463E"
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E5ED5807-55B7-47C5-97A6-03233F4FBC3A"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE554781-1EB9-446E-911F-6C11970C47F4"
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668"
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A10BC294-9196-425F-9FB0-B1625465B47F"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00720D8C-3FF3-4B1C-B74B-91F01A544399"
},
{
"criteria": "cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3ED68ADD-BBDA-4485-BC76-58F011D72311"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@adobe.com",
"cisaRequiredAction": "The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.",
"cisaVulnerabilityName": "Adobe Flash Player Integer Underflow Vulnerablity"
}