Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
|
|
|
|
|
|
|
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
|
|
|
|
Become a Partner and License Our Database or Notification Service
|
|
|
|
|
|
|
|
|
|
|
|
|
(Adobe Issues Fix for AIR) Adobe Flash Player Multiple Flaws Let Remote Users Execute Arbitrary Code and Bypass Cross-Domain Origin Restrictions
|
|
SecurityTracker Alert ID: 1026315 |
|
SecurityTracker URL: http://securitytracker.com/id/1026315
|
|
CVE Reference:
CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2458, CVE-2011-2459, CVE-2011-2460
(Links to External Site)
|
Updated: Apr 18 2012
|
Original Entry Date: Nov 11 2011
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 3.0 and prior
|
Description:
Multiple vulnerabilities were reported in Adobe Flash Player. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can bypass cross-domain policy restrictions. Adobe AIR is affected.
A remote user can create specially crafted Flash content that, when loaded by the target user, will execute arbitrary code on the target user's system. The code will run with the privileges of the target user.
A remote user can trigger memory corruption errors [CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, CVE-2011-2460].
A remote user can trigger a heap corruption error [CVE-2011-2450].
A remote user can trigger a buffer overflow [CVE-2011-2456].
A remote user can trigger a stack overflow [CVE-2011-2457].
A remote user can bypass cross-domain policy restrictions for users with Internet Explorer [CVE-2011-2458].
Tavis Ormandy of the Google Security Team, an anonymous reporter (via iDefense's Vulnerability Contributor Program), lakehu of Tencent Security Center, Bo Qu of Palo Alto Networks, Ben Hawkes of the Google Security Team, and Ivan Golenkov and Alexander Gostev of Kaspersky Lab reported these vulnerabilities.
|
Impact:
A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.
A remote user can bypass cross-domain policy restrictions.
|
Solution:
Adobe has issued a fix (3.1.0.4880).
The Adobe advisory is available at:
http://www.adobe.com/support/security/bulletins/apsb11-28.html
|
Vendor URL: www.adobe.com/support/security/bulletins/apsb11-28.html (Links to External Site)
|
Cause:
Access control error, Boundary error
|
Underlying OS:
Android, UNIX (OS X), Windows (Any)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 11 Nov 2011 16:24:44 +0000
Subject: http://www.adobe.com/support/security/bulletins/apsb11-28.html
|
CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453,
CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2458,
CVE-2011-2459, CVE-2011-2460
|
|
Go to the Top of This SecurityTracker Archive Page
|
