Multiple vulnerabilities in Adobe AIR

1) Buffer overflow

EUVDB-ID: #VU44519

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2445

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14312
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15761

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU44520

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2450

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14507
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16217

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU44521

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2451

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13961
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15759

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU44522

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2452

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14189
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16079

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU44523

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2453

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2454, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14231
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15862

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU44524

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2454

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2455, CVE-2011-2459, and CVE-2011-2460.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14003
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15942

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Buffer overflow

EUVDB-ID: #VU44525

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2455

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2459, and CVE-2011-2460.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14510
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16023

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Buffer overflow

EUVDB-ID: #VU44526

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2456

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer overflow in Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14215
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16046

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Stack-based buffer overflow

EUVDB-ID: #VU44527

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2457

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing unspecified vectors. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update to version 3.1.0.4880.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14165
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15687

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Buffer overflow

EUVDB-ID: #VU44528

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2459

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2460.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13904
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15756

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU44529

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2011-2460

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Flash Player before 10.3.183.11 and 11.x before 11.1.102.55 on Windows, Mac OS X, Linux, and Solaris and before 11.1.102.59 on Android, and Adobe AIR before 3.1.0.4880, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2445, CVE-2011-2451, CVE-2011-2452, CVE-2011-2453, CVE-2011-2454, CVE-2011-2455, and CVE-2011-2459.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe AIR: 3.1.0.485 - 3.1.0.488

CPE2.3

External links

http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2011-11/msg00019.html
http://secunia.com/advisories/48819
http://security.gentoo.org/glsa/glsa-201204-07.xml
http://www.adobe.com/support/security/bulletins/apsb11-28.html
http://www.redhat.com/support/errata/RHSA-2011-1445.html
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14260
http://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15836

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	11
CVE-ID	CVE-2011-2445 CVE-2011-2450 CVE-2011-2451 CVE-2011-2452 CVE-2011-2453 CVE-2011-2454 CVE-2011-2455 CVE-2011-2456 CVE-2011-2457 CVE-2011-2459 CVE-2011-2460
CWE-ID	CWE-119 CWE-121
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Adobe AIR Client/Desktop applications / Multimedia software
Vendor	Adobe