| Package | Affected versions | Patched versions |
|---|---|---|
| adobe air | = 13.0.0.111= 13.0.0.83= 14.0.0.110≤ 14.0.0.110≤ 14.0.0.137 | |
| adobe air sdk | = 13.0.0.111= 13.0.0.83= 14.0.0.110≤ 14.0.0.137 | |
| flash player | = 11.2.202.223= 11.2.202.228= 11.2.202.233= 11.2.202.235= 11.2.202.236= 11.2.202.238= 11.2.202.243= 11.2.202.251= 11.2.202.258= 11.2.202.261= 11.2.202.262= 11.2.202.270= 11.2.202.273= 11.2.202.275= 11.2.202.280= 11.2.202.285= 11.2.202.291= 11.2.202.297= 11.2.202.310= 11.2.202.332= 11.2.202.335= 11.2.202.336= 11.2.202.341= 11.2.202.346= 11.2.202.350= 11.2.202.356= 11.2.202.359= 11.2.202.378= 13.0.0.182= 13.0.0.201= 13.0.0.206= 13.0.0.214= 13.0.0.223= 14.0.0.125= 14.0.0.145≤ 11.2.202.394≤ 13.0.0.231 |
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free