Security bypass in Adobe Flash Player for Linux and Adobe Flash Player - CVE-2014-0580

Vulnerability identifier: #VU5227

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2014-0580

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to circumvent the Same Origin Policy on the target system.

The weakness exists due to an error in the setClipboard() function. A remote attacker can create a specially crafted shockwave file, trick the victim into into viewing it and insert persistent data into the clipboard.

Successful exploitation of the vulnerability results in security bypass on the vulnerable system.

Adobe Flash Player for Linux
Adobe Flash Player
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation

Install update from vendor's website.

• https://helpx.adobe.com/security/products/flash-player/apsb14-27.html

• Multiple vulnerabilities in Adobe Flash Player
• Arch Linux update for flashplugin
• Gentoo update for Adobe Flash Player
• SUSE Linux update for flash-player
• OpenSUSE Linux update for flash-player
• OpenSUSE Linux update for flash-player
• Red Hat update for flash-plugin