Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.
Published 2014-02-21 05:07:00
Updated 2024-12-20 14:22:23
View at NVD,   CVE.org
Vulnerability category: Memory CorruptionExecute code

Products affected by CVE-2014-0502

CVE-2014-0502 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Adobe Flash Player Double Free Vulnerablity
CISA required action:
The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
CISA description:
Adobe Flash Player contains a double free vulnerability that allows a remote attacker to execute arbitrary code.
Notes:
https://www.adobe.com/products/flashplayer/end-of-life-alternative.html#eol-alternative-faq ; https://nvd.nist.gov/vuln/detail/CVE-2014-0502
Added on 2024-09-17 Action due date 2024-10-08

Exploit prediction scoring system (EPSS) score for CVE-2014-0502

35.02%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-0502

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
10.0
HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
NIST
8.8
HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2.8
5.9
134c704f-9b21-4f2e-91b3-4a467353bcc0 2024-09-18
8.8
HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
2.8
5.9
NIST 2024-09-19

CWE ids for CVE-2014-0502

  • Assigned by: nvd@nist.gov (Primary)
  • The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
    Assigned by:
    • 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
    • nvd@nist.gov (Primary)

References for CVE-2014-0502

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!