Bilou

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player (affected versions not specified) Adobe Integrated Runtime (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted filter value in a TextField object. **Recommendations** For Adobe Flash Player, consider disabling the use of filters in TextField objects until a patch is available. For Adobe Integrated Runtime, restrict access to the vulnerable components to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions prior to 18.0.0.268 Adobe Flash Player versions 19.x Adobe Flash Player versions 20.x prior to 20.0.0.228 Adobe AIR versions prior to 20.0.0.204 Adobe AIR SDK versions prior to 20.0.0.204 Adobe AIR SDK & Compiler versions prior to 20.0.0.204 Adobe Flash Player version 11.2.202.554 and earlier on Linux **Description** The issue is related to errors in the code of the SharedObject object implementation in Adobe Flash Player and Adobe Integrated Runtime. It allows a remote attacker to execute arbitrary code by exploiting an unspecified "type confusion" during a `getRemote` call. **Recommendations** For Adobe Flash Player versions prior to 18.0.0.268, update to version 18.0.0.268 or later. For Adobe Flash Player versions 19.x, update to a version outside of the 19.x range. For Adobe Flash Player versions 20.x prior to 20.0.0.228, update to version 20.0.0.228 or later. For Adobe AIR versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe AIR SDK versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe AIR SDK & Compiler versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe Flash Player version 11.2.202.554 and earlier on Linux, update to a version later than 11.2.202.554.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player (affected versions not specified) Adobe Integrated Runtime (affected versions not specified) **Description** The issue is related to the implementation of the MovieClip object in Flash Player and Adobe Integrated Runtime, which involves the use of memory after it has been freed. This can be exploited by a remote attacker using a specially crafted filter value, potentially allowing the execution of arbitrary code. **Recommendations** For Adobe Flash Player, consider disabling the MovieClip object until a patch is available. For Adobe Integrated Runtime, restrict access to the MovieClip object to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions prior to 18.0.0.268 Adobe Flash Player versions 19.x Adobe Flash Player versions 20.x prior to 20.0.0.228 Adobe AIR versions prior to 20.0.0.204 Adobe AIR SDK versions prior to 20.0.0.204 Adobe AIR SDK & Compiler versions prior to 20.0.0.204 Adobe Flash Player version prior to 11.2.202.554 on Linux **Description** The issue is caused by an integer overflow in the Shader filter implementation, allowing attackers to execute arbitrary code via a large `BitmapData` source object. This can be exploited by a remote attacker to execute arbitrary code. **Recommendations** For Adobe Flash Player versions prior to 18.0.0.268, update to version 18.0.0.268 or later. For Adobe Flash Player versions 19.x, update to a version that includes the fix. For Adobe Flash Player versions 20.x prior to 20.0.0.228, update to version 20.0.0.228 or later. For Adobe AIR versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe AIR SDK versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe AIR SDK & Compiler versions prior to 20.0.0.204, update to version 20.0.0.204 or later. For Adobe Flash Player version prior to 11.2.202.554 on Linux, update to version 11.2.202.554 or later. As a temporary workaround, consider restricting the use of large `BitmapData` source objects until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player (affected versions not specified) Adobe Integrated Runtime (affected versions not specified) **Description** The issue is related to the implementation of the Color object in Flash Player and Adobe Integrated Runtime, specifically a use-after-free condition. This can be exploited by a remote attacker using a specially crafted `setTransform` argument, potentially allowing the execution of arbitrary code. **Recommendations** For Adobe Flash Player, consider disabling the `setTransform` function until a patch is available. For Adobe Integrated Runtime, restrict access to the Color object to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player (affected versions not specified) Adobe Integrated Runtime (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed in the implementation of the DisplacementMapFilter object. This can be exploited by a remote attacker using a specially crafted value of the `mapBitmap` property, potentially allowing the execution of arbitrary code. **Recommendations** For Adobe Flash Player, consider disabling the DisplacementMapFilter object until a patch is available. For Adobe Integrated Runtime, restrict access to the DisplacementMapFilter object to minimize the risk of exploitation. Avoid using the `mapBitmap` property in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player (affected versions not specified) Adobe Integrated Runtime (affected versions not specified) **Description** The issue is related to the implementation of the MovieClip object in Flash Player and Adobe Integrated Runtime, specifically a use-after-free memory error. This can be exploited by a remote attacker using a specially crafted call to the `lineTo` method, potentially allowing the execution of arbitrary code. **Recommendations** For Adobe Flash Player, consider disabling the `lineTo` method in the MovieClip object as a temporary workaround until a patch is available. For Adobe Integrated Runtime, restrict access to the MovieClip object to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime versions (affected versions not specified) Adobe Flash Player versions (affected versions not specified) **Description** The issue is related to a use-after-free condition, which can be triggered by processing arguments of the `actionInstanceOf` function. This can potentially allow a remote attacker to execute arbitrary code. **Recommendations** For Adobe Integrated Runtime, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Flash Player, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime and Flash Player (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code by calling the LoadSound function. This is a use-after-free vulnerability that can lead to remote code execution. **Recommendations** For Adobe Integrated Runtime and Flash Player, consider disabling the LoadSound function as a temporary workaround until a patch is available. Restrict access to the sound loading functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime versions (affected versions not specified) Adobe Flash Player versions (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code using arguments such as `setMask`. This can potentially lead to remote code execution. **Recommendations** For Adobe Integrated Runtime, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Flash Player, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player versions prior to 18.0.0.261 Adobe Flash Player versions 19.x prior to 19.0.0.245 Adobe AIR versions prior to 19.0.0.241 Adobe AIR SDK versions prior to 19.0.0.241 Adobe AIR SDK & Compiler versions prior to 19.0.0.241 **Description** The issue is related to errors in data type mixing in Adobe Integrated Runtime and Flash Player, allowing a remote attacker to execute arbitrary code by leveraging an unspecified "type confusion" in the NetConnection object implementation. **Recommendations** For Adobe Flash Player versions prior to 18.0.0.261, update to version 18.0.0.261 or later. For Adobe Flash Player versions 19.x prior to 19.0.0.245, update to version 19.0.0.245 or later. For Adobe AIR versions prior to 19.0.0.241, update to version 19.0.0.241 or later. For Adobe AIR SDK versions prior to 19.0.0.241, update to version 19.0.0.241 or later. For Adobe AIR SDK & Compiler versions prior to 19.0.0.241, update to version 19.0.0.241 or later. As a temporary workaround, consider restricting access to the NetConnection object until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime versions (affected versions not specified) Adobe Flash Player versions (affected versions not specified) **Description** The issue is related to a use-after-free condition, which can be exploited by a remote attacker to execute arbitrary code. This is achieved through the processing of arguments of the `actionCallMethod` function. **Recommendations** For Adobe Integrated Runtime, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Flash Player, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime versions (affected versions not specified) Adobe Flash Player versions (affected versions not specified) **Description** The issue is related to a use-after-free condition, which can be exploited by a remote attacker to execute arbitrary code. This is achieved through the processing of arguments of the `actionImplementsOp` function. **Recommendations** For Adobe Integrated Runtime, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Flash Player, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime versions (affected versions not specified) Adobe Flash Player versions (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code by processing arguments of the `actionExtends` function. This is a remote code execution vulnerability. **Recommendations** For Adobe Integrated Runtime, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Flash Player, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime versions (affected versions not specified) Adobe Flash Player versions (affected versions not specified) **Description** The issue is related to a use-after-free error in memory handling. It can be exploited by a remote attacker to execute arbitrary code when processing arguments of the `attachSound` function. **Recommendations** For Adobe Integrated Runtime, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Flash Player, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime versions (affected versions not specified) Adobe Flash Player versions (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code. This is achieved through the processing of arguments in the `globalToLocal` function. **Recommendations** For Adobe Integrated Runtime, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Flash Player, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime versions (affected versions not specified) Adobe Flash Player versions (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code when processing the `gridFitType` property value. **Recommendations** For Adobe Integrated Runtime, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Flash Player, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Integrated Runtime versions (affected versions not specified) Adobe Flash Player versions (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code when processing the `DefineFunction` function. **Recommendations** For Adobe Integrated Runtime, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Adobe Flash Player, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player (affected versions not specified) Adobe Integrated Runtime (affected versions not specified) **Description** The issue is related to a use-after-free condition, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted TextLine object. This can potentially allow the attacker to gain control over the affected system. **Recommendations** For Adobe Flash Player, consider disabling the use of TextLine objects until a patch is available. For Adobe Integrated Runtime, restrict access to components that utilize TextLine objects to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Flash Player (affected versions not specified) Adobe Integrated Runtime (affected versions not specified) **Description** The issue is related to the use of memory after it has been freed, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted Video object. This can lead to remote code execution. **Recommendations** For Adobe Flash Player, consider disabling the use of Video objects until a patch is available. For Adobe Integrated Runtime, restrict access to memory allocation functions to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.