CVE-2014-5333
Detail
Modified After Enrichment
This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.
Current Description
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
View Analysis Description
Analysis
Description
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '{1}apos; (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
Base
Score:
NVD assessment
not yet provided.
CVSS 2.0 Severity and Vector Strings:
Vector:
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Change History
10 change records found show changes
CVE Modified by Adobe Systems Incorporated
6/16/2026 8:11:23 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Affected |
[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]
|
CVE Status Change
5/06/2026 6:30:45 PM
| Action |
Type |
Old Value |
New Value |
CVE Modified by CVE
11/20/2024 9:11:51 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
http://helpx.adobe.com/security/products/flash-player/apsb14-18.html
|
| Added |
Reference |
http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/
|
| Added |
Reference |
https://exchange.xforce.ibmcloud.com/vulnerabilities/95418
|
CVE Modified by Adobe Systems Incorporated
5/13/2024 11:17:45 PM
| Action |
Type |
Old Value |
New Value |
CVE Modified by Adobe Systems Incorporated
9/07/2017 9:29:05 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
https://exchange.xforce.ibmcloud.com/vulnerabilities/95418 [No Types Assigned]
|
| Removed |
Reference |
http://xforce.iss.net/xforce/xfdb/95418 [No Types Assigned]
|
CVE Modified by Adobe Systems Incorporated
1/06/2017 10:00:27 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Reference |
http://xforce.iss.net/xforce/xfdb/95418 [No Types Assigned]
|
CVE Modified by Adobe Systems Incorporated
12/15/2016 9:59:03 PM
| Action |
Type |
Old Value |
New Value |
| Changed |
Description |
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '{1}apos; (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
|
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
|
CVE Translated by NIST
2/17/2016 3:45:08 PM
| Action |
Type |
Old Value |
New Value |
| Added |
Translation |
Adobe Flash Player en versiones anteriores a 13.0.0.241 y 14.x en versiones anteriores a 14.0.0.176 en Windows y OS X y en versiones anteriores a 11.2.202.400 en Linux, Adobe AIR en versiones anteriores a 14.0.0.178 en Windows y OS X y en versiones anteriores a 14.0.0.179 en Android, Adobe AIR SDK en versiones anteriores a 14.0.0.178 y Adobe AIR SDK & Compiler en versiones anteriores a 14.0.0.178 no restringe adecuadamente el formato de archivo SWF, lo que permite a atacantes remotos llevar a cabo ataques de CSRF contra el dispositivo final JSONP, y obtener información sensible, a través de un elemento OBJECT manipulado con contenido SWF que satisface los requerimientos de juegos de caracteres de una API de retorno de llamada, junto con una manipulación que implica un caracter '{1}apos; (simbolo de dolar) o '(' (apertura de paréntesis). NOTA: este problema existe debido a una solución incompleta para CVE-2014-4671.
|
| Removed |
Translation |
Adobe Flash Player anterior a 13.0.0.241 y 14.x anterior a 14.0.0.176 en Windows y OS X y anterior a 11.2.202.400 en Linux, Adobe AIR anterior a 14.0.0.178 en Windows y OS X y anterior a 14.0.0.179 en Android, Adobe AIR SDK anterior a 14.0.0.178, y Adobe AIR SDK & Compiler anterior a 14.0.0.178 no restringen debidamente el formato de ficheros SWF, lo que permite a atacantes remotos realizar ataques de CSRF contra los endpoints JSONP, y obtener información sensible, a través de un elemento OBJECT manipulado con contenido SWF que satisface los requisitos de juegos de caracteres de una API de devolución de llamada, en conjunto con una manipulación que involucra un caracter '{1}apos; (signo de dolar) o '(' (abrir parentesis). NOTA: este problema existe debido a una solución incompleta para el CVE-2014-4671.
|
Modified Analysis by NIST
9/22/2015 2:49:11 PM
| Action |
Type |
Old Value |
New Value |
| Changed |
Description |
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
|
Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '{1}apos; (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671.
|
| Changed |
CVSS V2 |
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
|
(AV:N/AC:M/Au:N/C:P/I:N/A:N)
|
| Changed |
CPE Configuration |
Record truncated, showing 2048 of 4026 characters.
View Entire Change Record
Configuration 1
OR
*cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.137:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*
Configuration 2
AND
OR
*cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.231:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*
OR
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
Configuration 3
AND
OR
*cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*
OR
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
Configuration 4
AND
OR
*cpe:2.3:a:adobe:flash_player:11.2.202.394:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.335:*:*:*:*:*
|
Record truncated, showing 2048 of 4026 characters.
View Entire Change Record
Configuration 1
AND
OR
*cpe:2.3:a:adobe:adobe_air:14.0.0.137:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:adobe:adobe_air:14.0.0.110:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:adobe_air:13.0.0.111:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:adobe_air:13.0.0.83:*:*:*:*:*:*:*
OR
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
Configuration 2
AND
OR
*cpe:2.3:a:adobe:flash_player:14.0.0.145:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:14.0.0.125:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.231:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:adobe:flash_player:13.0.0.223:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.182:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.201:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.206:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:13.0.0.214:*:*:*:*:*:*:*
OR
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
Configuration 3
OR
*cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.137:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:adobe:adobe_air_sdk:14.0.0.110:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.111:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:adobe_air_sdk:13.0.0.83:*:*:*:*:*:*:*
Configuration 4
AND
OR
*cpe:2.3:a:adobe:flash_player:11.2.202.394:*:*:*:*:*:*:* (and previous)
*cpe:2.3:a:adobe:flash_player:11.2.202.378:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.356:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.350:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.346:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.341:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.336:*:*:*:*:*:*:*
*cpe:2.3:a:adobe:flash_player:11.2.202.335:*
|
Initial CVE Analysis
8/19/2014 11:49:57 AM
| Action |
Type |
Old Value |
New Value |
Quick Info
CVE Dictionary Entry: CVE-2014-5333 NVD
Published Date: 08/19/2014 NVD
Last Modified: 06/16/2026
Source: Adobe Systems Incorporated
|
