Skip to main content
Learn More
McNeese Information Security keyboard banner

Updates for Multiple Vulnerabilities in Adobe Flash Player

Updates for Multiple Vulnerabilities in Adobe Flash Player

CIS ADVISORY NUMBER: 2014-050

Executive Summary

06/10/2014
A security update has been released to address multiple vulnerabilities in Adobe Flash Player. Adobe Flash Player is a widely distributed multimedia and application player used to enhance the user experience when visiting web pages or reading email messages. Successful exploitation of this vulnerability could result in an attacker gaining the same privileges as the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Failed exploit attempts will likely cause denial-of-service conditions.

Threat Intelligence

There currently no reports of these vulnerabilities being exploited in the wild.

Systems Affected

  • Adobe Flash Player 13.0.0.214 and earlier versions for Windows
  • Adobe Flash Player 13.0.0.214 and earlier versions for Macintosh
  • Adobe Flash Player 11.2.202.359 and earlier versions for Linux

Risk

Government
  • Large and medium government entities: High
  • Small government entities: High
Businesses
  • Large and medium business entities: High
  • Small business entities: High
Home users
  • High

Technical Summary

A security update has been released to address multiple vulnerabilities in Adobe Flash Player. These vulnerabilities can be exploited if a user visits or is redirected to a specially crafted webpage, or opens a specially crafted file. This security update addresses the following vulnerabilities:
  • Multiple cross-site scripting vulnerabilities (CVE-2014-0531, CVE-2014-0532, CVE-2014-0533).
  • Multiple security bypass vulnerabilities (CVE-2014-0534, CVE-2014-0535).
  • A memory corruption vulnerability that could result in arbitrary code execution (CVE-2014-0536).
Successful exploitation of these vulnerabilities could result in an attacker taking control of an affected machine.
To verify the version of Adobe Flash Player installed on your system, access the About Flash Player page (www[.]adobe[.]com/products/flash/about), or right-click on content running in Flash Player and select “About Adobe (or Macromedia) Flash Player” from the menu. If you use multiple browsers, perform the check for each browser you have installed on your system to determine if one is using a vulnerable version of Flash.

Recommendations

We recommend the following actions be taken:
  • Install the updates provided by Adobe immediately after appropriate testing.
  • Remind users not to visit untrusted websites or follow links provided by unknown or untrusted sources.
  • Do not open email attachments from unknown or untrusted sources.

References

Adobe:
CVE:

TLP:WHITE
Traffic Light Protocol (TLP): WHITE information may be distributed without restriction, subject to copyright controls.
http://www.us-cert.gov/tlp/
 
Note: This alert is intended to identify system-related announcements (system exploits, vulnerabilities, virus attacks, etc.) The information is obtained from several sources including the DHS/US-CERT, SANS, and vendor community. The OIT security office does not validate the information. The intent is to alert the agency personnel on possible exploits, system vulnerabilities, virus attacks and hacker attacks. In each instance we will attempt to provide a specific address relative to the problem and the corresponding patch or fix.

OIT-SEC-ALERT@LISTSERV.DOA.LA.GOV