CVE-2014-5333 (GCVE-0-2014-5333)

Vulnerability from cvelistv5 – Published: 2014-08-19 10:00 – Updated: 2024-08-06 11:41
VLAI?
Summary
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:41:48.692Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html"
          },
          {
            "name": "adobe-cve20145333-csrf(95418)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95418"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-08-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK \u0026 Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a \u0027$\u0027 (dollar sign) or \u0027(\u0027 (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-07T15:57:01",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html"
        },
        {
          "name": "adobe-cve20145333-csrf(95418)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95418"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "ID": "CVE-2014-5333",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK \u0026 Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a \u0027$\u0027 (dollar sign) or \u0027(\u0027 (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html",
              "refsource": "CONFIRM",
              "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html"
            },
            {
              "name": "adobe-cve20145333-csrf(95418)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95418"
            },
            {
              "name": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/",
              "refsource": "MISC",
              "url": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2014-5333",
    "datePublished": "2014-08-19T10:00:00",
    "dateReserved": "2014-08-18T00:00:00",
    "dateUpdated": "2024-08-06T11:41:48.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"14.0.0.137\", \"matchCriteriaId\": \"83D55436-5B93-4285-865A-7CDEBAB23CEA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C898203-9D6E-4430-8905-C28180F954E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"434B6846-3ED5-4F23-88D1-567668EE8E94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CB252359-318A-4054-8CEA-D08AB7500100\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:google:android:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8255F035-04C8-4158-B301-82101711939C\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"13.0.0.231\", \"matchCriteriaId\": \"DFE450E1-FE4E-4BDD-BD7D-5844AFC0C676\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C3DD6547-ABEE-4734-87AA-BD3E247226B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0732FFB7-4BFD-499D-A166-9128F3DABA0B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C282F91D-C1FE-4CC7-A33D-8E43F85DF168\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"11E8C1F3-83AA-468B-8F5A-285F3BD19CC6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"59F08016-055D-4B70-8085-9C657481BA9C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D5D7202D-56DF-400B-9F09-E7D9938222D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D4F0D21-A64B-46C1-9591-96529661DF0B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0FF5999A-9D12-4CDD-8DE9-A89C10B2D574\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2CF61F35-5905-4BA9-AD7E-7DB261D2F256\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"14.0.0.137\", \"matchCriteriaId\": \"EADFC4AC-861F-4F47-AF20-18EED3866C41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B005E5AC-DD7D-413E-92A2-4E8D7F3F2D7A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F228403E-68B3-4B18-B120-066346D80891\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"73E1378C-8C12-4728-BC84-2836691C2B11\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"11.2.202.394\", \"matchCriteriaId\": \"7374A426-E2EB-49A2-8E4E-DE4DA0C4EC9F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"146E1EAC-B9AF-4511-A0DC-A048428E3B68\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5AFBB9EA-1A66-4FBC-BF89-7DF04FDD6788\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"39065E60-3680-4384-95C0-EF4F874D2400\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2B0603B3-5C98-422D-A49D-EBE1798DAE69\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5AC7882D-1577-4CEA-B1C0-0FEBC91A441A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CED86796-B721-49B1-A021-82FA769FA024\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF7843C6-628A-4091-8A09-6E126A89870E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"472F569C-0FD5-4F61-A4D6-258A8A9C4008\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1E91A468-191C-4A2D-B1B6-0DDE8BB1C1D8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"47F94E94-C190-4559-8FF6-FEEE6634B67B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7CC3FDE1-44FD-4BC3-BB43-C44C94D3F794\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FE46E137-5298-44FA-B40C-6079C9AEE60F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D14EAFB3-3718-466F-8EB2-61D00D569251\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD3390A0-8EB6-424E-96AC-B87E22D6FF6E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CCD935A5-D923-48CC-9699-977C5123D52C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5AABFF8D-2C2A-4B8B-9DE2-C74EECEDD86F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD0EF3E4-C91F-4AD4-91E7-A10DC66DE4A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3DDB9C24-953C-4268-8C4A-E7C0F021698E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E8474A98-24F4-43E5-9402-319F68A9880B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0CD7F4E8-742E-4264-84EE-22D9E3CB3C76\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"97DBA814-D400-440C-BEEA-AB1913F783C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9CDA6379-D70E-476C-82C5-C916C13CA081\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"515589AD-8CC1-46CE-9F9A-BAAD725E2C8F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"308488AB-3D95-4231-8201-BF4EE5C9C151\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DDB40406-277E-4BF5-ADCF-BE16B1CF390B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"33165339-9DCC-46B2-B22F-CF31D26175D7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.359:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"28AB62F3-9CB0-4ED8-9785-2B4878BB101D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF423A60-6377-4782-B809-D6304322F391\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"155AD4FB-E527-4103-BCEF-801B653DEA37\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"14.0.0.110\", \"matchCriteriaId\": \"1601647A-06A7-4D82-9BF0-5DCAAC5A2114\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C898203-9D6E-4430-8905-C28180F954E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"434B6846-3ED5-4F23-88D1-567668EE8E94\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0FF5999A-9D12-4CDD-8DE9-A89C10B2D574\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2CF61F35-5905-4BA9-AD7E-7DB261D2F256\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK \u0026 Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a \u0027$\u0027 (dollar sign) or \u0027(\u0027 (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.\"}, {\"lang\": \"es\", \"value\": \"Adobe Flash Player en versiones anteriores a 13.0.0.241 y 14.x en versiones anteriores a 14.0.0.176 en Windows y OS X y en versiones anteriores a 11.2.202.400 en Linux, Adobe AIR en versiones anteriores a 14.0.0.178 en Windows y OS X y en versiones anteriores a 14.0.0.179 en Android, Adobe AIR SDK en versiones anteriores a 14.0.0.178 y Adobe AIR SDK \u0026 Compiler en versiones anteriores a 14.0.0.178 no restringe adecuadamente el formato de archivo SWF, lo que permite a atacantes remotos llevar a cabo ataques de CSRF contra puntos finales JSONP y obtener informaci\\u00f3n sensible, a trav\\u00e9s de un elemento OBJECT manipulado con contenido SWF que satisface los requerimientos de set de caract\\u00e9res de una llamada de retorno API, en conjunto con una manipulaci\\u00f3n que involucra un caracter \u0027$\u0027 (signo de dolar) o \u0027(\u0027 (par\\u00e9ntesis abierto). NOTA: este problema existe por un arreglo incompleto para CVE-2014-4671.\"}]",
      "id": "CVE-2014-5333",
      "lastModified": "2024-11-21T02:11:51.340",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:N/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2014-08-19T11:16:59.853",
      "references": "[{\"url\": \"http://helpx.adobe.com/security/products/flash-player/apsb14-18.html\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/\", \"source\": \"psirt@adobe.com\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/95418\", \"source\": \"psirt@adobe.com\"}, {\"url\": \"http://helpx.adobe.com/security/products/flash-player/apsb14-18.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/95418\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "psirt@adobe.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-5333\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2014-08-19T11:16:59.853\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK \u0026 Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a \u0027$\u0027 (dollar sign) or \u0027(\u0027 (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.\"},{\"lang\":\"es\",\"value\":\"Adobe Flash Player en versiones anteriores a 13.0.0.241 y 14.x en versiones anteriores a 14.0.0.176 en Windows y OS X y en versiones anteriores a 11.2.202.400 en Linux, Adobe AIR en versiones anteriores a 14.0.0.178 en Windows y OS X y en versiones anteriores a 14.0.0.179 en Android, Adobe AIR SDK en versiones anteriores a 14.0.0.178 y Adobe AIR SDK \u0026 Compiler en versiones anteriores a 14.0.0.178 no restringe adecuadamente el formato de archivo SWF, lo que permite a atacantes remotos llevar a cabo ataques de CSRF contra puntos finales JSONP y obtener informaci\u00f3n sensible, a trav\u00e9s de un elemento OBJECT manipulado con contenido SWF que satisface los requerimientos de set de caract\u00e9res de una llamada de retorno API, en conjunto con una manipulaci\u00f3n que involucra un caracter \u0027$\u0027 (signo de dolar) o \u0027(\u0027 (par\u00e9ntesis abierto). NOTA: este problema existe por un arreglo incompleto para CVE-2014-4671.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:N/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"14.0.0.137\",\"matchCriteriaId\":\"83D55436-5B93-4285-865A-7CDEBAB23CEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C898203-9D6E-4430-8905-C28180F954E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"434B6846-3ED5-4F23-88D1-567668EE8E94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CB252359-318A-4054-8CEA-D08AB7500100\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:google:android:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8255F035-04C8-4158-B301-82101711939C\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"13.0.0.231\",\"matchCriteriaId\":\"DFE450E1-FE4E-4BDD-BD7D-5844AFC0C676\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3DD6547-ABEE-4734-87AA-BD3E247226B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0732FFB7-4BFD-499D-A166-9128F3DABA0B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C282F91D-C1FE-4CC7-A33D-8E43F85DF168\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11E8C1F3-83AA-468B-8F5A-285F3BD19CC6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59F08016-055D-4B70-8085-9C657481BA9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5D7202D-56DF-400B-9F09-E7D9938222D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D4F0D21-A64B-46C1-9591-96529661DF0B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FF5999A-9D12-4CDD-8DE9-A89C10B2D574\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CF61F35-5905-4BA9-AD7E-7DB261D2F256\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"14.0.0.137\",\"matchCriteriaId\":\"EADFC4AC-861F-4F47-AF20-18EED3866C41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B005E5AC-DD7D-413E-92A2-4E8D7F3F2D7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F228403E-68B3-4B18-B120-066346D80891\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"73E1378C-8C12-4728-BC84-2836691C2B11\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"11.2.202.394\",\"matchCriteriaId\":\"7374A426-E2EB-49A2-8E4E-DE4DA0C4EC9F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"146E1EAC-B9AF-4511-A0DC-A048428E3B68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5AFBB9EA-1A66-4FBC-BF89-7DF04FDD6788\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"39065E60-3680-4384-95C0-EF4F874D2400\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B0603B3-5C98-422D-A49D-EBE1798DAE69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5AC7882D-1577-4CEA-B1C0-0FEBC91A441A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CED86796-B721-49B1-A021-82FA769FA024\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF7843C6-628A-4091-8A09-6E126A89870E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"472F569C-0FD5-4F61-A4D6-258A8A9C4008\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E91A468-191C-4A2D-B1B6-0DDE8BB1C1D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"47F94E94-C190-4559-8FF6-FEEE6634B67B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7CC3FDE1-44FD-4BC3-BB43-C44C94D3F794\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE46E137-5298-44FA-B40C-6079C9AEE60F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D14EAFB3-3718-466F-8EB2-61D00D569251\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD3390A0-8EB6-424E-96AC-B87E22D6FF6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CCD935A5-D923-48CC-9699-977C5123D52C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5AABFF8D-2C2A-4B8B-9DE2-C74EECEDD86F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD0EF3E4-C91F-4AD4-91E7-A10DC66DE4A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3DDB9C24-953C-4268-8C4A-E7C0F021698E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8474A98-24F4-43E5-9402-319F68A9880B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CD7F4E8-742E-4264-84EE-22D9E3CB3C76\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97DBA814-D400-440C-BEEA-AB1913F783C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9CDA6379-D70E-476C-82C5-C916C13CA081\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"515589AD-8CC1-46CE-9F9A-BAAD725E2C8F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"308488AB-3D95-4231-8201-BF4EE5C9C151\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DDB40406-277E-4BF5-ADCF-BE16B1CF390B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33165339-9DCC-46B2-B22F-CF31D26175D7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.359:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28AB62F3-9CB0-4ED8-9785-2B4878BB101D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF423A60-6377-4782-B809-D6304322F391\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"155AD4FB-E527-4103-BCEF-801B653DEA37\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"14.0.0.110\",\"matchCriteriaId\":\"1601647A-06A7-4D82-9BF0-5DCAAC5A2114\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C898203-9D6E-4430-8905-C28180F954E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"434B6846-3ED5-4F23-88D1-567668EE8E94\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FF5999A-9D12-4CDD-8DE9-A89C10B2D574\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CF61F35-5905-4BA9-AD7E-7DB261D2F256\"}]}]}],\"references\":[{\"url\":\"http://helpx.adobe.com/security/products/flash-player/apsb14-18.html\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/\",\"source\":\"psirt@adobe.com\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/95418\",\"source\":\"psirt@adobe.com\"},{\"url\":\"http://helpx.adobe.com/security/products/flash-player/apsb14-18.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/95418\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.