{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-08-15T00:00:00", "descriptions": [{"lang": "en", "value": "Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-07T15:57:01", "orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html"}, {"name": "adobe-cve20145333-csrf(95418)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95418"}, {"tags": ["x_refsource_MISC"], "url": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@adobe.com", "ID": "CVE-2014-5333", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html", "refsource": "CONFIRM", "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html"}, {"name": "adobe-cve20145333-csrf(95418)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95418"}, {"name": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/", "refsource": "MISC", "url": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T11:41:48.692Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html"}, {"name": "adobe-cve20145333-csrf(95418)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95418"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/"}]}]}, "cveMetadata": {"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "cveId": "CVE-2014-5333", "datePublished": "2014-08-19T10:00:00", "dateReserved": "2014-08-18T00:00:00", "dateUpdated": "2024-08-06T11:41:48.692Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*", "matchCriteriaId": "83D55436-5B93-4285-865A-7CDEBAB23CEA", "versionEndIncluding": "14.0.0.137", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*", "matchCriteriaId": "3C898203-9D6E-4430-8905-C28180F954E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*", "matchCriteriaId": "434B6846-3ED5-4F23-88D1-567668EE8E94", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:*", "matchCriteriaId": "CB252359-318A-4054-8CEA-D08AB7500100", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "matchCriteriaId": "8255F035-04C8-4158-B301-82101711939C", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*", "matchCriteriaId": "DFE450E1-FE4E-4BDD-BD7D-5844AFC0C676", "versionEndIncluding": "13.0.0.231", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*", "matchCriteriaId": "C3DD6547-ABEE-4734-87AA-BD3E247226B7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*", "matchCriteriaId": "0732FFB7-4BFD-499D-A166-9128F3DABA0B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*", "matchCriteriaId": "C282F91D-C1FE-4CC7-A33D-8E43F85DF168", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*", "matchCriteriaId": "11E8C1F3-83AA-468B-8F5A-285F3BD19CC6", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:*", "matchCriteriaId": "59F08016-055D-4B70-8085-9C657481BA9C", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*", "matchCriteriaId": "D5D7202D-56DF-400B-9F09-E7D9938222D3", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*", "matchCriteriaId": "4D4F0D21-A64B-46C1-9591-96529661DF0B", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FF5999A-9D12-4CDD-8DE9-A89C10B2D574", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:adobe_air_sdk:*:*:*:*:*:*:*:*", "matchCriteriaId": "EADFC4AC-861F-4F47-AF20-18EED3866C41", "versionEndIncluding": "14.0.0.137", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*", "matchCriteriaId": "B005E5AC-DD7D-413E-92A2-4E8D7F3F2D7A", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*", "matchCriteriaId": "F228403E-68B3-4B18-B120-066346D80891", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:*", "matchCriteriaId": "73E1378C-8C12-4728-BC84-2836691C2B11", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*", "matchCriteriaId": "7374A426-E2EB-49A2-8E4E-DE4DA0C4EC9F", "versionEndIncluding": "11.2.202.394", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.223:*:*:*:*:*:*:*", "matchCriteriaId": "146E1EAC-B9AF-4511-A0DC-A048428E3B68", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.228:*:*:*:*:*:*:*", "matchCriteriaId": "5AFBB9EA-1A66-4FBC-BF89-7DF04FDD6788", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.233:*:*:*:*:*:*:*", "matchCriteriaId": "39065E60-3680-4384-95C0-EF4F874D2400", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.235:*:*:*:*:*:*:*", "matchCriteriaId": "2B0603B3-5C98-422D-A49D-EBE1798DAE69", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.236:*:*:*:*:*:*:*", "matchCriteriaId": "5AC7882D-1577-4CEA-B1C0-0FEBC91A441A", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.238:*:*:*:*:*:*:*", "matchCriteriaId": "CED86796-B721-49B1-A021-82FA769FA024", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.243:*:*:*:*:*:*:*", "matchCriteriaId": "FF7843C6-628A-4091-8A09-6E126A89870E", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.251:*:*:*:*:*:*:*", "matchCriteriaId": "472F569C-0FD5-4F61-A4D6-258A8A9C4008", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.258:*:*:*:*:*:*:*", "matchCriteriaId": "1E91A468-191C-4A2D-B1B6-0DDE8BB1C1D8", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.261:*:*:*:*:*:*:*", "matchCriteriaId": "47F94E94-C190-4559-8FF6-FEEE6634B67B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.262:*:*:*:*:*:*:*", "matchCriteriaId": "7CC3FDE1-44FD-4BC3-BB43-C44C94D3F794", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.270:*:*:*:*:*:*:*", "matchCriteriaId": "FE46E137-5298-44FA-B40C-6079C9AEE60F", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.273:*:*:*:*:*:*:*", "matchCriteriaId": "D14EAFB3-3718-466F-8EB2-61D00D569251", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.275:*:*:*:*:*:*:*", "matchCriteriaId": "FD3390A0-8EB6-424E-96AC-B87E22D6FF6E", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.280:*:*:*:*:*:*:*", "matchCriteriaId": "CCD935A5-D923-48CC-9699-977C5123D52C", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.285:*:*:*:*:*:*:*", "matchCriteriaId": "5AABFF8D-2C2A-4B8B-9DE2-C74EECEDD86F", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.291:*:*:*:*:*:*:*", "matchCriteriaId": "DD0EF3E4-C91F-4AD4-91E7-A10DC66DE4A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.297:*:*:*:*:*:*:*", "matchCriteriaId": "3DDB9C24-953C-4268-8C4A-E7C0F021698E", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.310:*:*:*:*:*:*:*", "matchCriteriaId": "E8474A98-24F4-43E5-9402-319F68A9880B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.332:*:*:*:*:*:*:*", "matchCriteriaId": "0CD7F4E8-742E-4264-84EE-22D9E3CB3C76", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*:*:*", "matchCriteriaId": "97DBA814-D400-440C-BEEA-AB1913F783C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*", "matchCriteriaId": "9CDA6379-D70E-476C-82C5-C916C13CA081", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*", "matchCriteriaId": "515589AD-8CC1-46CE-9F9A-BAAD725E2C8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*", "matchCriteriaId": "308488AB-3D95-4231-8201-BF4EE5C9C151", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*", "matchCriteriaId": "DDB40406-277E-4BF5-ADCF-BE16B1CF390B", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*", "matchCriteriaId": "33165339-9DCC-46B2-B22F-CF31D26175D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.359:*:*:*:*:*:*:*", "matchCriteriaId": "28AB62F3-9CB0-4ED8-9785-2B4878BB101D", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:*", "matchCriteriaId": "AF423A60-6377-4782-B809-D6304322F391", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "155AD4FB-E527-4103-BCEF-801B653DEA37", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:*", "matchCriteriaId": "1601647A-06A7-4D82-9BF0-5DCAAC5A2114", "versionEndIncluding": "14.0.0.110", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*", "matchCriteriaId": "3C898203-9D6E-4430-8905-C28180F954E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*", "matchCriteriaId": "434B6846-3ED5-4F23-88D1-567668EE8E94", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FF5999A-9D12-4CDD-8DE9-A89C10B2D574", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*", "matchCriteriaId": "2CF61F35-5905-4BA9-AD7E-7DB261D2F256", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671."}, {"lang": "es", "value": "Adobe Flash Player en versiones anteriores a 13.0.0.241 y 14.x en versiones anteriores a 14.0.0.176 en Windows y OS X y en versiones anteriores a 11.2.202.400 en Linux, Adobe AIR en versiones anteriores a 14.0.0.178 en Windows y OS X y en versiones anteriores a 14.0.0.179 en Android, Adobe AIR SDK en versiones anteriores a 14.0.0.178 y Adobe AIR SDK & Compiler en versiones anteriores a 14.0.0.178 no restringe adecuadamente el formato de archivo SWF, lo que permite a atacantes remotos llevar a cabo ataques de CSRF contra puntos finales JSONP y obtener informaci\u00f3n sensible, a trav\u00e9s de un elemento OBJECT manipulado con contenido SWF que satisface los requerimientos de set de caract\u00e9res de una llamada de retorno API, en conjunto con una manipulaci\u00f3n que involucra un caracter '$' (signo de dolar) o '(' (par\u00e9ntesis abierto). NOTA: este problema existe por un arreglo incompleto para CVE-2014-4671."}], "id": "CVE-2014-5333", "lastModified": "2024-11-21T02:11:51.340", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2014-08-19T11:16:59.853", "references": [{"source": "psirt@adobe.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html"}, {"source": "psirt@adobe.com", "url": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/"}, {"source": "psirt@adobe.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95418"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://helpx.adobe.com/security/products/flash-player/apsb14-18.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/95418"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2014:1051", "cpe": "cpe:/a:redhat:rhel_extras:5", "package": "flash-plugin-0:11.2.202.400-1.el5", "product_name": "Supplementary for Red Hat Enterprise Linux 5", "release_date": "2014-08-13T00:00:00Z"}, {"advisory": "RHSA-2014:1051", "cpe": "cpe:/a:redhat:rhel_extras:6", "package": "flash-plugin-0:11.2.202.400-1.el6", "product_name": "Supplementary for Red Hat Enterprise Linux 6", "release_date": "2014-08-13T00:00:00Z"}], "bugzilla": {"description": "flash-plugin: multiple code execution or security bypass flaws (APSB14-18)", "id": "1129417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129417"}, "csaw": false, "cvss": {"cvss_base_score": "6.8", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "status": "verified"}, "details": ["Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671."], "name": "CVE-2014-5333", "public_date": "2014-08-12T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-5333\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-5333\nhttp://helpx.adobe.com/security/products/flash-player/apsb14-18.html"], "threat_severity": "Critical", "upstream_fix": "flash-plugin 11.2.202.400"}