CVE-2014-0491

Vulnerability

Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X, and before 11.2.202.335 on Linux, as well as Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 contain a vulnerability that allows attackers to bypass unspecified protection mechanisms. The exact nature of the bypass and the affected components are not disclosed in the available references [1].

Exploitation

The exploitation vectors are not detailed in the public sources. The description indicates that attackers can exploit this vulnerability via unknown vectors, suggesting that the required conditions and steps are not publicly known [1].

Impact

Successful exploitation enables an attacker to bypass unspecified protection mechanisms. The precise impact on confidentiality, integrity, or availability is not specified, but such a bypass could facilitate further attacks against the affected systems [1].

Mitigation

Adobe released fixed versions: Flash Player 11.7.700.260 and 12.0.0.38 for Windows and Mac OS X, 11.2.202.335 for Linux; and Adobe AIR 4.0.0.1390 (including SDK and SDK & Compiler). Red Hat Enterprise Linux users can obtain updates via RHSA-2014-0028 [1]. No workarounds are documented in the available references.