CyberSecBulletin
CVE-2014-9163Exploited in the wildNVD status: Analyzed

Adobe Flash Player Stack-Based Buffer Overflow

Published Updated By the CyberSecBulletin desk

CVE-2014-9163 is a high-severity stack-based buffer overflow vulnerability in Flash Player from Adobe, with a CVSS 2.0 base score of 10.0 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 13.0.0.259, 15.0.0.246, 11.2.202.425 as the first without the flaw, so updating Flash Player to one of those releases or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on April 13, 2022, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update Flash Player to 13.0.0.259 or 15.0.0.246 or 11.2.202.425, whichever matches your release line, or a later version.
  2. CISA's required action: The impacted product is end-of-life and should be disconnected if still in use.
  3. Read the advisory on helpx.adobe.com for workarounds and exact fixed builds.
  4. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
AdobeFlash Player13.0 up to, but not including, 13.0.0.259; 14.0 through 14.0.0.179; 15.0 up to, but not including, 15.0.0.246; 11.0 up to, but not including, 11.2.202.42513.0.0.259, 15.0.0.246, 11.2.202.425

Version data comes from NVD's product matching. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Access vector
NetworkCan be exploited remotely over a network.
Access complexity
LowNo special conditions are needed.
Authentication
NoneNo login is needed.
Confidentiality
CompleteAll data can be read.
Integrity
CompleteAny data can be modified.
Availability
CompleteThe system can be shut down completely.

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.8HighCISA (ADP)
CVSS 2.010.0HighNVD

Official description

Stack-based buffer overflow in Adobe Flash Player before 13.0.0.259 and 14.x and 15.x before 15.0.0.246 on Windows and OS X and before 11.2.202.425 on Linux allows attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in December 2014.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Stack-based Buffer Overflow

The product writes past the end of a buffer that was allocated on the stack.

How developers prevent this class of flaw

  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.
  • Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Implement and perform bounds checking on input.

More Stack-based Buffer Overflow vulnerabilities (CWE-121)

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. Deadline for US federal agencies to remediate, set by CISA.
  4. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
  5. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Other references

Other vulnerabilities in Flash Player

All Flash Player vulnerabilities

Recent Stack-based Buffer Overflow vulnerabilities

Spotted an error? Tell us.