Product:
Adobe Flash Player
Summary
Adobe Flash Player and Adobe AIR prior to specified versions on multiple platforms, as well as Authplay.dll in Adobe Reader and Acrobat, allow remote attackers to execute arbitrary code or cause a denial of service via crafted Flash content. This vulnerability was actively exploited in the wild in April 2011, demonstrating the potential for significant impact on affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2011-0611 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious Microsoft Office document that contains an embedded .swf file with specific characteristics, such as size inconsistencies and object type confusion. When the document is opened by a user, the crafted Flash content can trigger the vulnerability, leading to arbitrary code execution or application crashes.
Affected Products
- Adobe Flash Player: Vulnerable versions include those before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris, and 10.2.156.12 and earlier on Android.
- Adobe AIR: Vulnerable versions are those before 2.6.19140.
- Adobe Reader: Versions 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, and 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X are affected.
- Adobe Acrobat: Versions 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X are also vulnerable.
Mitigation
The impacted product is end-of-life and should be disconnected if still in use. Users are advised to upgrade to supported software versions or alternative solutions to mitigate the risk of exploitation.