PT-2011-1246 · Adobe+2 · Reader+5

Bannedit · Published 2011-03-15 · Updated 2025-02-13 · CVE-2011-0609

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions 10.2.154.13 and earlier Adobe Flash Player versions 10.1.106.16 and earlier on Android Adobe AIR version 2.5.1 and earlier Adobe Reader and Acrobat versions 9.x through 9.4.2 Adobe Reader and Acrobat versions 10.x through 10.0.1

Description The issue allows remote attackers to execute arbitrary code or cause a denial of service via crafted Flash content. It is related to a buffer overflow in memory, which can be exploited by a remote attacker to execute arbitrary code. The vulnerability has been exploited in the wild, as demonstrated by a .swf file embedded in an Excel spreadsheet.

Recommendations For Adobe Flash Player versions 10.2.154.13 and earlier, update to a version later than 10.2.154.13. For Adobe Flash Player versions 10.1.106.16 and earlier on Android, update to a version later than 10.1.106.16. For Adobe AIR version 2.5.1 and earlier, update to a version later than 2.5.1. For Adobe Reader and Acrobat versions 9.x through 9.4.2, update to a version later than 9.4.2. For Adobe Reader and Acrobat versions 10.x through 10.0.1, update to a version later than 10.0.1.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2022-03557

CVE-2011-0609

RHSA-2011:0372

RHSA-2011_0372

Affected Products

Air

Acrobat

Flash Player

Reader

Office Excel

Red Hat

References · 34

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flashplayer_avm.rb · Exploit
• 🔥 https://exploit-db.com/exploits/17027 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-0609 · Security Note
• https://bdu.fstec.ru/vul/2022-03557 · Security Note
• http://adobe.com/support/security/advisories/apsa11-01.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0372.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14147 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0609 · Note
• http://securityfocus.com/bid/46860 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66078 · Note
• https://access.redhat.com/security/cve/CVE-2011-0609 · Note
• http://vupen.com/english/advisories/2011/0656 · Note
• http://securitytracker.com/id?1025238 · Note
• http://blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.html · Note