Patchfirst
Patchfirst
CVE-2014-0515 Public exploit EPSS 94.5%

Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and…

Summary

A buffer overflow in Adobe Flash Player, affecting the Flash Player component on Windows, OS X, and Linux across the affected version ranges. An remote attacker can execute arbitrary code through unspecified vectors.

Official description · CVE.org

Buffer overflow in Adobe Flash Player before 11.7.700.279 and 11.8.x through 13.0.x before 13.0.0.206 on Windows and OS X, and before 11.2.202.356 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in April 2014.

Breakdown
78.2 / 100
Exploited
Yes, in VulnCheck KEV
Reports
2
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited the day it was disclosed. Public exploit code (Metasploit) was available 1 day before disclosure.

  1. Public exploit codeMetasploit1 day before
  2. DisclosedFirst seen exploitedVulnCheck KEV evidenceday 0

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Drive-by Compromise T1189 Medium
AI mapping from the description · how it is exploited

drive-by via browser-delivered Flash content

allows remote attackers to execute arbitrary code via unspecified vectors
From the official description (CVE.org) Original (opens in a new tab) ↗

ExecutionTA0002

Exploitation for Client Execution T1203 Medium
AI mapping from the description · primary impact

code executes within Flash Player client

Buffer overflow in Adobe Flash Player before 11.7.700.279
From the official description (CVE.org) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 38 general rules for its techniques

Rules for this CVE

0 that reference CVE-2014-0515 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules
Exploitation for Client ExecutionT120335 general rules
All 35 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 2 threat reports
2 reportsProofpointMicrosoft

Reports are matched by finding the exact id CVE-2014-0515 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 7 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

8 links, grouped by NVD tag

vdb-entry 2

securityfocus.com/bid/67092securitytracker.com/id/1030155

vendor-advisory 5

lists.opensuse.org/opensuse-security-announce/2014-04/msg00017.htmllists.opensuse.org/opensuse-security-announce/2014-05/msg00000.htmlsecurity.gentoo.org/glsa/glsa-201405-04.xmllists.opensuse.org/opensuse-security-announce/2014-05/msg00001.htmlrhn.redhat.com/errata/RHSA-2014-0447.html

x_refsource_CONFIRM 1

helpx.adobe.com/security/products/flash-player/apsb14-13.html
↑ ↓ chooseEnter openEsc close