Read the docs
TI-2014-00513 Aliases CVE-2014-0535GHSA-hr39-v5pv-7qq4

Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and…

Priority MEDIUM 45CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.

Summary

Adobe Flash Player before 13.0.0.223 and 14.x before 14.0.0.125 on Windows and OS X and before 11.2.202.378 on Linux, Adobe AIR before 14.0.0.110, Adobe AIR SDK before 14.0.0.110, and Adobe AIR SDK & Compiler before 14.0.0.110 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2014-0534.

Why it matters now

EPSS 0.10052 95th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 38

CPEVersionsRoleVendor
cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*up to 13.0.0.111VulnerableAdobe
cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*13.0.0.83VulnerableAdobe
cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*up to 13.0.0.111VulnerableAdobe
cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*13.0.0.83VulnerableAdobe
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*up to 11.2.202.359VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*11.2.202.223VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*11.2.202.228VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*11.2.202.233VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*11.2.202.235VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*11.2.202.236VulnerableAdobe
  • cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:* Versions up to 13.0.0.111 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:* Versions 13.0.0.83 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:* Versions up to 13.0.0.111 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:* Versions 13.0.0.83 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* Versions up to 11.2.202.359 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:* Versions 11.2.202.223 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:* Versions 11.2.202.228 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:* Versions 11.2.202.233 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:* Versions 11.2.202.235 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:* Versions 11.2.202.236 Vulnerable ·Adobe
Show 28 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*11.2.202.238VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*11.2.202.243VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*11.2.202.251VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*11.2.202.258VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:*11.2.202.261VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:*11.2.202.262VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:*11.2.202.270VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:*11.2.202.273VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:*11.2.202.275VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:*11.2.202.280VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:*11.2.202.285VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:*11.2.202.291VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:*11.2.202.297VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:*11.2.202.310VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:*11.2.202.332VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:*11.2.202.335VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*11.2.202.336VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*11.2.202.341VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*11.2.202.346VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*11.2.202.350VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*11.2.202.356VulnerableAdobe
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*all versionsRunning onLinux
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*up to 13.0.0.214VulnerableAdobe
cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*13.0.0.182VulnerableAdobe
cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*13.0.0.201VulnerableAdobe
cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*13.0.0.206VulnerableAdobe
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*all versionsRunning onApple
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
  • cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:* Versions 11.2.202.238 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:* Versions 11.2.202.243 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:* Versions 11.2.202.251 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:* Versions 11.2.202.258 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:* Versions 11.2.202.261 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:* Versions 11.2.202.262 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:* Versions 11.2.202.270 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:* Versions 11.2.202.273 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:* Versions 11.2.202.275 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:* Versions 11.2.202.280 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:* Versions 11.2.202.285 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:* Versions 11.2.202.291 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:* Versions 11.2.202.297 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:* Versions 11.2.202.310 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:* Versions 11.2.202.332 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:* Versions 11.2.202.335 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:* Versions 11.2.202.336 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:* Versions 11.2.202.341 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:* Versions 11.2.202.346 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:* Versions 11.2.202.350 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:* Versions 11.2.202.356 Vulnerable ·Adobe
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions all versions Running on ·Linux
  • cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* Versions up to 13.0.0.214 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:* Versions 13.0.0.182 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:* Versions 13.0.0.201 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:* Versions 13.0.0.206 Vulnerable ·Adobe
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions all versions Running on ·Apple
  • cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft

Remediation

Red Hat 1 advisory

  • RHSA-2014:0745 Released 2014-06-11 · Red Hat rating Critical
    flash-plugin security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) flash-plugin-11.2.202.378-1.el5.i386
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) flash-plugin-11.2.202.378-1.el6
    • Red Hat Enterprise Linux Server Supplementary (v. 5) flash-plugin-11.2.202.378-1.el5.i386
    • Red Hat Enterprise Linux Server Supplementary (v. 6) flash-plugin-11.2.202.378-1.el6
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) flash-plugin-11.2.202.378-1.el6

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Desktop Supplementary (v. 5)Fixed RHSA-2014:0745
Red Hat Enterprise Linux Desktop Supplementary (v. 6)Fixed RHSA-2014:0745
Red Hat Enterprise Linux Server Supplementary (v. 5)Fixed RHSA-2014:0745
Red Hat Enterprise Linux Server Supplementary (v. 6)Fixed RHSA-2014:0745
Red Hat Enterprise Linux Workstation Supplementary (v. 6)Fixed RHSA-2014:0745

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0535
  2. 2026-10-03 Alias added: GHSA-hr39-v5pv-7qq4

References

Patch 1

Advisory 5

  • TI-2014-00481 Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through… KEVCVSS 3.1HIGH 8.8
  • TI-2011-00534 Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and… KEVCVSS 3.1HIGH 8.8
  • TI-2014-00534 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x… CVSS 2.0HIGH 10.0
  • TI-2011-01863 Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before… CVSS 2.0HIGH 10.0
  • TI-2014-00537 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x… CVSS 2.0HIGH 10.0
  • TI-2011-02110 Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and… CVSS 2.0HIGH 10.0
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences