Description
Adobe Flash Player before 11.7.700.260 and 11.8.x and 11.9.x before 12.0.0.38 on Windows and Mac OS X and before 11.2.202.335 on Linux, Adobe AIR before 4.0.0.1390, Adobe AIR SDK before 4.0.0.1390, and Adobe AIR SDK & Compiler before 4.0.0.1390 allow attackers to defeat the ASLR protection mechanism by leveraging an "address leak."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | flash-plugin | 11.2.202.335-1.el6 | RHSA-2014:0028 |
| RHEL 5 | flash-plugin | 11.2.202.335-1.el5 | RHSA-2014:0028 |
Advisories 1
- RHSA-2014:0028 Red Hat Security Advisory: flash-plugin security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- openSUSE-SU-2014:0128 vendor-advisory
- RHSA-2014:0028 vendor-advisory
- 56636 third-party-advisory
- 1029602 vdb-entry
- 56516 third-party-advisory
- http://helpx.adobe.com/security/products/flash-player/apsb14-02.html