Vulnerability Change Records for CVE-2014-5333

Change History

Modified Analysis 9/22/2015 2:49:11 PM

Action Type Old Value New Value
Changed CPE Configuration
Configuration 1
     OR
          *cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.137:*:*:*:*:*:*:* (and previous)
          *cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:*
          *cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*
          *cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*
Configuration 2
     AND
          OR
               *cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.231:*:*:*:*:*:*:* (and previous)
               *cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*
          OR
               cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
               cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
Configuration 3
     AND
          OR
               *cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:* (and previous)
               *cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*
          OR
               cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
               cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
Configuration 4
     AND
          OR
               *cpe:2.3:a:adobe:flash_player:11.2.202.394:*:*:*:*:*:*:* (and previous)
               *cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.359:*:*:*:*:*:*:*
          OR
               cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Configuration 5
     AND
          OR
               *cpe:2.3:a:adobe:adobe_air:14.0.0.137:*:*:*:*:*:*:* (and previous)
               *cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*
          OR
               cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
Configuration 1
     AND
          OR
               *cpe:2.3:a:adobe:adobe_air:14.0.0.137:*:*:*:*:*:*:* (and previous)
               *cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*
          OR
               cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
Configuration 2
     AND
          OR
               *cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.231:*:*:*:*:*:*:* (and previous)
               *cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*
          OR
               cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
               cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
Configuration 3
     OR
          *cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.137:*:*:*:*:*:*:* (and previous)
          *cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:*
          *cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*
          *cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*
Configuration 4
     AND
          OR
               *cpe:2.3:a:adobe:flash_player:11.2.202.394:*:*:*:*:*:*:* (and previous)
               *cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:flash_player:11.2.202.359:*:*:*:*:*:*:*
          OR
               cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Configuration 5
     AND
          OR
               *cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:* (and previous)
               *cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*
               *cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*
          OR
               cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
               cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
Changed CVSS V2
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
Changed Description
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '{1}apos; (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.

CVE Translated 2/17/2016 3:45:08 PM

Action Type Old Value New Value
Added Translation

								
							
							
						
Adobe Flash Player en versiones anteriores a 13.0.0.241 y 14.x en versiones anteriores a 14.0.0.176 en Windows y OS X y en versiones anteriores a 11.2.202.400 en Linux, Adobe AIR en versiones anteriores a 14.0.0.178 en Windows y OS X y en versiones anteriores a 14.0.0.179 en Android, Adobe AIR SDK en versiones anteriores a 14.0.0.178 y Adobe AIR SDK & Compiler en versiones anteriores a 14.0.0.178 no restringe adecuadamente el formato de archivo SWF, lo que permite a atacantes remotos llevar a cabo ataques de CSRF contra el dispositivo final JSONP, y obtener información sensible, a través de un elemento OBJECT manipulado con contenido SWF que satisface los requerimientos de juegos de caracteres de una API de retorno de llamada, junto con una manipulación que implica un caracter '{1}apos; (simbolo de dolar) o '(' (apertura de paréntesis). NOTA: este problema existe debido a una solución incompleta para CVE-2014-4671.
Removed Translation
Adobe Flash Player anterior a 13.0.0.241 y 14.x anterior a 14.0.0.176 en Windows y OS X y anterior a 11.2.202.400 en Linux, Adobe AIR anterior a 14.0.0.178 en Windows y OS X y anterior a 14.0.0.179 en Android, Adobe AIR SDK anterior a 14.0.0.178, y Adobe AIR SDK & Compiler anterior a 14.0.0.178 no restringen debidamente el formato de ficheros SWF, lo que permite a atacantes remotos realizar ataques de CSRF contra los endpoints JSONP, y obtener información sensible, a través de un elemento OBJECT manipulado con contenido SWF que satisface los requisitos de juegos de caracteres de una API de devolución de llamada, en conjunto con una manipulación que involucra un caracter '{1}apos; (signo de dolar) o '(' (abrir parentesis). NOTA: este problema existe debido a una solución incompleta para el CVE-2014-4671.

								
						

CVE Modified by MITRE 9/07/2017 9:29:05 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
https://exchange.xforce.ibmcloud.com/vulnerabilities/95418 [No Types Assigned]
Removed Reference
http://xforce.iss.net/xforce/xfdb/95418 [No Types Assigned]

								
						

CVE Modified by MITRE 1/06/2017 10:0:27 PM

Action Type Old Value New Value
Added Reference

								
							
							
						
http://xforce.iss.net/xforce/xfdb/95418 [No Types Assigned]

Initial CVE Analysis 8/19/2014 11:49:57 AM

Action Type Old Value New Value