PT-2011-1248 · Adobe+2 · Flash Player+5

Published 2011-04-11 · Updated 2026-02-10 · CVE-2011-0611

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions prior to 10.2.154.27 Adobe AIR versions prior to 2.6.19140 Adobe Reader 9.x versions prior to 9.4.4 and 10.x versions prior to 10.0.1 on Windows, and prior to 10.0.3 on Mac OS X Adobe Acrobat 9.x versions prior to 9.4.4 and 10.x versions prior to 10.0.3 on Windows and Mac OS X

Description The issue is related to a buffer overflow in the Authplay.dll library when incompatible data types are used, allowing a remote attacker to execute arbitrary code or cause a denial of service via crafted Flash content, such as a Microsoft Office document with an embedded .swf file containing size inconsistencies, object type confusion, and malicious ActionScript. This issue has been exploited in the wild.

Recommendations For Adobe Flash Player versions prior to 10.2.154.27, update to version 10.2.154.27 or later. For Adobe AIR versions prior to 2.6.19140, update to version 2.6.19140 or later. For Adobe Reader 9.x versions prior to 9.4.4 and 10.x versions prior to 10.0.1 on Windows, and prior to 10.0.3 on Mac OS X, update to the respective fixed versions or later. For Adobe Acrobat 9.x versions prior to 9.4.4 and 10.x versions prior to 10.0.3 on Windows and Mac OS X, update to the respective fixed versions or later. As a temporary workaround, consider disabling the use of Flash content in Adobe Reader and Adobe Acrobat until the issue is resolved.

Exploit

Fix

RCE

DoS

Type Confusion

Buffer Overflow

Weakness Enumeration

CWE-843

CWE-119

Related Identifiers

BDU:2022-04094

CVE-2011-0611

RHSA-2011:0451

RHSA-2011_0451

Affected Products

Air

Acrobat

Flash Player

Reader

Office

Red Hat

References · 38

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/browser/adobe_flashplayer_flash10o.rb · Exploit
• 🔥 http://exploit-db.com/exploits/17175 · Exploit
• 🔥 http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html · Exploit
• 🔥 https://exploit-db.com/exploits/17175 · Exploit
• 🔥 http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html · Exploit
• 🔥 https://exploit-db.com/exploits/17473 · Exploit
• http://adobe.com/support/security/bulletins/apsb11-08.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04094 · Security Note
• http://vupen.com/english/advisories/2011/0923 · Vendor Advisory
• http://adobe.com/support/security/advisories/apsa11-02.html · Vendor Advisory
• http://secunia.com/advisories/44119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0611 · Security Note
• http://vupen.com/english/advisories/2011/0922 · Vendor Advisory
• http://secunia.com/advisories/44149 · Vendor Advisory
• http://adobe.com/support/security/bulletins/apsb11-07.html · Vendor Advisory