Read the docs
TI-2014-00516 Aliases CVE-2014-0538GHSA-wvpx-3jvr-hpw3

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.241 and 14.x before…

Priority MEDIUM 53Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Use-after-free vulnerability in Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 allows attackers to execute arbitrary code via unspecified vectors.

Why it matters now

EPSS 0.07552 94th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 50

CPEVersionsRoleVendor
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*up to 11.2.202.394VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*11.2.202.223VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*11.2.202.228VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*11.2.202.233VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*11.2.202.235VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*11.2.202.236VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*11.2.202.238VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*11.2.202.243VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*11.2.202.251VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*11.2.202.258VulnerableAdobe
  • cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* Versions up to 11.2.202.394 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:* Versions 11.2.202.223 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:* Versions 11.2.202.228 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:* Versions 11.2.202.233 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:* Versions 11.2.202.235 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:* Versions 11.2.202.236 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:* Versions 11.2.202.238 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:* Versions 11.2.202.243 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:* Versions 11.2.202.251 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:* Versions 11.2.202.258 Vulnerable ·Adobe
Show 40 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:*11.2.202.261VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:*11.2.202.262VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:*11.2.202.270VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:*11.2.202.273VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:*11.2.202.275VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:*11.2.202.280VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:*11.2.202.285VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:*11.2.202.291VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:*11.2.202.297VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:*11.2.202.310VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:*11.2.202.332VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:*11.2.202.335VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*11.2.202.336VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*11.2.202.341VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*11.2.202.346VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*11.2.202.350VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*11.2.202.356VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.359:*:*:*:*:*:*:*11.2.202.359VulnerableAdobe
cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:*11.2.202.378VulnerableAdobe
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*all versionsRunning onLinux
cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*up to 14.0.0.137VulnerableAdobe
cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*13.0.0.83VulnerableAdobe
cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*13.0.0.111VulnerableAdobe
cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:*14.0.0.110VulnerableAdobe
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*all versionsRunning onGoogle
cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*up to 14.0.0.110VulnerableAdobe
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*all versionsRunning onApple
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*up to 14.0.0.137VulnerableAdobe
cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*13.0.0.83VulnerableAdobe
cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*13.0.0.111VulnerableAdobe
cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:*14.0.0.110VulnerableAdobe
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*up to 13.0.0.231VulnerableAdobe
cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*13.0.0.182VulnerableAdobe
cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*13.0.0.201VulnerableAdobe
cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*13.0.0.206VulnerableAdobe
cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*13.0.0.214VulnerableAdobe
cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:*13.0.0.223VulnerableAdobe
cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*14.0.0.125VulnerableAdobe
cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*14.0.0.145VulnerableAdobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:* Versions 11.2.202.261 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:* Versions 11.2.202.262 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:* Versions 11.2.202.270 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:* Versions 11.2.202.273 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:* Versions 11.2.202.275 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:* Versions 11.2.202.280 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:* Versions 11.2.202.285 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:* Versions 11.2.202.291 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:* Versions 11.2.202.297 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:* Versions 11.2.202.310 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:* Versions 11.2.202.332 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:* Versions 11.2.202.335 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:* Versions 11.2.202.336 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:* Versions 11.2.202.341 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:* Versions 11.2.202.346 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:* Versions 11.2.202.350 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:* Versions 11.2.202.356 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.359:*:*:*:*:*:*:* Versions 11.2.202.359 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:* Versions 11.2.202.378 Vulnerable ·Adobe
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions all versions Running on ·Linux
  • cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:* Versions up to 14.0.0.137 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:* Versions 13.0.0.83 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:* Versions 13.0.0.111 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:* Versions 14.0.0.110 Vulnerable ·Adobe
  • cpe:2.3:o:google:android:*:*:*:*:*:*:*:* Versions all versions Running on ·Google
  • cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:* Versions up to 14.0.0.110 Vulnerable ·Adobe
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions all versions Running on ·Apple
  • cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:* Versions up to 14.0.0.137 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:* Versions 13.0.0.83 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:* Versions 13.0.0.111 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:* Versions 14.0.0.110 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* Versions up to 13.0.0.231 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:* Versions 13.0.0.182 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:* Versions 13.0.0.201 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:* Versions 13.0.0.206 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:* Versions 13.0.0.214 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:* Versions 13.0.0.223 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:* Versions 14.0.0.125 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:* Versions 14.0.0.145 Vulnerable ·Adobe

Remediation

Red Hat 1 advisory

  • RHSA-2014:1051 Released 2014-08-13 · Red Hat rating Critical
    flash-plugin security update
    • Red Hat Enterprise Linux Desktop Supplementary (v. 5) flash-plugin-11.2.202.400-1.el5.i386
    • Red Hat Enterprise Linux Desktop Supplementary (v. 6) flash-plugin-11.2.202.400-1.el6
    • Red Hat Enterprise Linux Server Supplementary (v. 5) flash-plugin-11.2.202.400-1.el5.i386
    • Red Hat Enterprise Linux Server Supplementary (v. 6) flash-plugin-11.2.202.400-1.el6
    • Red Hat Enterprise Linux Workstation Supplementary (v. 6) flash-plugin-11.2.202.400-1.el6

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Desktop Supplementary (v. 5)Fixed RHSA-2014:1051
Red Hat Enterprise Linux Desktop Supplementary (v. 6)Fixed RHSA-2014:1051
Red Hat Enterprise Linux Server Supplementary (v. 5)Fixed RHSA-2014:1051
Red Hat Enterprise Linux Server Supplementary (v. 6)Fixed RHSA-2014:1051
Red Hat Enterprise Linux Workstation Supplementary (v. 6)Fixed RHSA-2014:1051

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0538
  2. 2026-10-03 Alias added: GHSA-wvpx-3jvr-hpw3

References

Patch 1

Advisory 2

  • TI-2014-00481 Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through… KEVCVSS 3.1HIGH 8.8
  • TI-2011-00534 Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and… KEVCVSS 3.1HIGH 8.8
  • TI-2014-00534 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x… CVSS 2.0HIGH 10.0
  • TI-2011-01863 Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before… CVSS 2.0HIGH 10.0
  • TI-2014-00537 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.244 and 14.x and 15.x… CVSS 2.0HIGH 10.0
  • TI-2011-02110 Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and… CVSS 2.0HIGH 10.0
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences