SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Multimedia)  >   Adobe AIR Vendors:   Adobe Systems Incorporated
(Adobe Issues Fix for AIR) Adobe Flash Player Multiple Flaws Let Remote Users Execute Arbitrary Code and Bypass Cross-Domain Origin Restrictions
SecurityTracker Alert ID:  1026315
SecurityTracker URL:  http://securitytracker.com/id/1026315
CVE Reference:   CVE-2011-2445, CVE-2011-2450, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2456, CVE-2011-2457, CVE-2011-2458, CVE-2011-2459, CVE-2011-2460   (Links to External Site)
Updated:  Apr 18 2012
Original Entry Date:  Nov 11 2011
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 3.0 and prior
Description:   Multiple vulnerabilities were reported in Adobe Flash Player. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can bypass cross-domain policy restrictions. Adobe AIR is affected.

A remote user can create specially crafted Flash content that, when loaded by the target user, will execute arbitrary code on the target user's system. The code will run with the privileges of the target user.

A remote user can trigger memory corruption errors [CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, CVE-2011-2460].

A remote user can trigger a heap corruption error [CVE-2011-2450].

A remote user can trigger a buffer overflow [CVE-2011-2456].

A remote user can trigger a stack overflow [CVE-2011-2457].

A remote user can bypass cross-domain policy restrictions for users with Internet Explorer [CVE-2011-2458].

Tavis Ormandy of the Google Security Team, an anonymous reporter (via iDefense's Vulnerability Contributor Program), lakehu of Tencent Security Center, Bo Qu of Palo Alto Networks, Ben Hawkes of the Google Security Team, and Ivan Golenkov and Alexander Gostev of Kaspersky Lab reported these vulnerabilities.

Impact:   A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.

A remote user can bypass cross-domain policy restrictions.

Solution:   Adobe has issued a fix (3.1.0.4880).

The Adobe advisory is available at:

http://www.adobe.com/support/security/bulletins/apsb11-28.html

Vendor URL:  www.adobe.com/support/security/bulletins/apsb11-28.html (Links to External Site)
Cause:   Access control error, Boundary error
Underlying OS:  Android, UNIX (macOS/OS X), Windows (Any)

Message History:   This archive entry is a follow-up to the message listed below.
Nov 11 2011 Adobe Flash Player Multiple Flaws Let Remote Users Execute Arbitrary Code and Bypass Cross-Domain Origin Restrictions



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC