{"id":"CVE-2014-0515","published":"2014-04-29T10:00:00Z","modified":"2024-08-06T09:20:19Z","title":"Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014.","provenance":"source","from":"CVE.org"},"summary":{"text":"A buffer overflow in Adobe Flash Player, affecting the Flash Player component on Windows, OS X, and Linux across the affected version ranges. An remote attacker can execute arbitrary code through unspecified vectors.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:44Z"},"cvss":null,"epss":{"score":0.94487,"percentile":0.99852,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2014-04-29","exploitedFirstSeen":"2014-04-29","ransomware":true,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0515","date":"2014-04-29"},{"url":"https://unit42.paloaltonetworks.com/recent-watering-hole-attacks-attributed-apt-group-th3bug-using-poison-ivy/","date":"2014-09-19"},{"url":"https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html","date":"2015-04-18"},{"url":"https://resources.infosecinstitute.com/topic/animal-farm-apt-and-the-shadow-of-france-intelligence/","date":"2015-07-08"},{"url":"https://securelist.com/the-mysterious-case-of-cve-2016-0034-the-hunt-for-a-microsoft-silverlight-0-day/73255/","date":"2016-01-13"},{"url":"https://marcoramilli.com/2019/12/05/apt28-attacks-evolution/","date":"2019-12-05"},{"url":"https://www.scribd.com/document/516749423/inzimam-2019-ijca-919742","date":"2019-12-26"},{"url":"https://cybersecurityworks.com/blog/ransomware/why-old-is-gold-for-ransomware.html","date":"2021-04-26"},{"url":"https://www.logpoint.com/wp-content/uploads/2024/06/logpoint-etpr-forest-blizzard.pdf","date":"2024-05-31"}],"evidenceTotal":9,"provenance":"source"},"exploited":true,"otx":{"pulseCount":7,"pulses":[{"name":"2015: Malware Analysis Report","url":"https://otx.alienvault.com/pulse/69f4dfa6405cf7858f1b732a","created":"2026-05-01"},{"name":"2011: Malware Analysis Report","url":"https://otx.alienvault.com/pulse/69f47e886aac3dce3a958d27","created":"2026-05-01"},{"name":"TrojanDownloader:Win32/Tsunovest.A","url":"https://otx.alienvault.com/pulse/67c659b2331a0c096ff6f026","created":"2025-03-04"},{"name":"Thor Lite Scanner - Cigabuntu (Parrot Version) vs. The Book of Shadows","url":"https://otx.alienvault.com/pulse/666ac558d08da6cfb3ba135b","created":"2024-06-13"},{"name":"Thor-Lite Linux 64 (06.11.24) - enriched a bit more but not 'pruned'","url":"https://otx.alienvault.com/pulse/6668b85065eec626e4766a38","created":"2024-06-11"},{"name":"IOC Records Provided by @NextRayAI","url":"https://otx.alienvault.com/pulse/63456c2a30b92337ea1670e0","created":"2022-10-11"},{"name":"Operation RussianDoll","url":"https://otx.alienvault.com/pulse/55346adeb45ff536ca3ffd2c","created":"2015-04-20"}],"provenance":"machine"},"cwes":[],"references":[{"url":"http://www.securityfocus.com/bid/67092","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-04/msg00017.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://security.gentoo.org/glsa/glsa-201405-04.xml","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2014-0447.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id/1030155","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://helpx.adobe.com/security/products/flash-player/apsb14-13.html","tags":["x_refsource_CONFIRM"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: drive-by via browser-delivered Flash content","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary code via unspecified vectors","start":157,"end":230}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: code executes within Flash Player client","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Buffer overflow in Adobe Flash Player before 11.7.700.279","start":0,"end":57}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-7337a86c8549e6b0b5ea","title":"2020 Financial Services and Insurance Industry Threat Report","publisher":"proofpoint.com","url":"https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-au-tr-financial-services-and-insurance.pdf","date":null,"mentions":[{"quote":"05/18/205/25/206/1/20\r\n200k\r\n180k\r\n160k\r\n140k\r\n100k\r\n80k\r\n60k\r\n40k\r\n20k\r\n0\r\nOffice VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS\r\nPDF Geofencing XL4 Macro Regsvr32 Compressed Executable Executable HTML\r\nScheduled Task\r\nBITS Jobs\r\nThreadkit\r\nBlackTDS\r\nLCG Kit\r\nCVE-2014-0515","start":27307,"end":27627},{"quote":"0/204/27/205/4/205/11/205/18/205/25/206/1/20\r\n600k\r\n400k\r\n300k\r\n200k\r\n100k\r\n0\r\nOffice VBA Macro Social Engineering PowerShell Thread Hijacking WMI Keitaro TDS RIG Exploit Kit VBS\r\nPDFGeofencing XL4 MacroRegsvr32 Compressed Executable\r\nExecutableHTML Scheduled Task\r\nBITS Jobs\r\nThreadkit\r\nBlackTDS\r\nLCG Kit\r\nCVE-2014-0515","start":33393,"end":33713}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":" CVE-2014-0515, the most commonly exploited Adobe Flash Player","start":93164,"end":93227},{"quote":"CVE-2014-0515","start":94060,"end":94073},{"quote":"43, 50\r\nCVE-2010-3336, 52\r\nCVE-2011-1823, 50, 51\r\nCVE-2011-3874, 50, 51\r\nCVE-2012-0158, 52\r\nCVE-2012-0507, 47, 49\r\nCVE-2012-1723, 47, 48, 49\r\nCVE-2012-1889, 54\r\nCVE-2013-0074, 46\r\nCVE-2013-0422, 47, 49\r\nCVE-2013-2460, 46\r\nCVE-2013-2551, 46, 54\r\nCVE-2013-7331, 54\r\nCVE-2014-0322, 54\r\nCVE-2014-0497, 53\r\nCVE-2014-0515,","start":238007,"end":238323}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2014-0546","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-0546","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":33333,"url":"https://www.exploit-db.com/exploits/33333","title":"Adobe Flash Player - Shader Buffer Overflow (Metasploit)","type":"remote","platform":"windows","date":"2014-05-12","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2014-05-12"},"metasploit":[{"name":"Adobe Flash Player Shader Buffer Overflow","module":"exploit/multi/browser/adobe_flash_pixel_bender_bof","type":"exploit","disclosureDate":"2014-04-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_pixel_bender_bof.rb"}],"first":{"date":"2014-04-28","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_pixel_bender_bof.rb"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1189"],"provenance":"ai"},{"stage":"primary","techniques":["T1203"],"provenance":"ai"}],"timeline":[{"date":"2014-04-28","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2014-05-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/adobe_flash_pixel_bender_bof.rb","provenance":"source"},{"date":"2014-04-29","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2014-0515","provenance":"source"},{"date":"2014-04-29","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2014-0515","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":78.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4566 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9985"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}