CERT-In Advisory
CIAD-2012-0055
Multiple Vulnerabilities in Adobe Flash Player and Adobe AIR
Original Issue Date: December 26, 2012
Severity Rating: High
Systems Affected
- Adobe Flash Player version 11.5.502.110 and earlier for Windows and Macintosh.
- Adobe Flash Player version 11.2.202.251 and earlier for Linux
- Adobe Flash Player version 11.1.115.27 and earlier for Android 4.x.
- Adobe Flash Player version 11.1.111.24 and earlier for Android 3.x.
- Adobe AIR version 3.5.0.600 and earlier for Windows and Macintosh.
Overview
Multiple vulnerabilities have been reported in Adobe Flash Player and Adobe AIR, which could be exploited by malicious people to compromise a user's system. Failed exploit attempts likely to result in denial-of-service conditions.
Description
1. Remote Buffer-Overflow Vulnerability
(
CVE-2012-5676
)
This vulnerability exists due to improper bounds checking of the user-supplied input. Successful exploitation of this vulnerability allow a remote attacker to execute arbitrary code via unspecified vectors in the context of the user running the affected application.
2. Heap Overflow Vulnerability
(
CVE-2012-5677
)
This vulnerability can be exploited by a remote attacker to execute arbitrary code via unspecified vectors in the context of the user running the affected application.
3.Memory Corruption Vulnerability
(
CVE-2012-5678
)
A memory corruption vulnerability exists and could be exploited by a malicious attacker via unspecified vectors in the context of the user running the affected application to cause execution of arbitrary code or denial-of-service conditions (DoS.
Solution
Apply patches as mentioned in Adobe Security Bulletin
APSB12-27
Vendor Information
Adobe
http://www.adobe.com/support/security/bulletins/apsb12-27.html
References
Security Tracker
http://secunia.com/advisories/51560/
Security focus
http://www.securityfocus.com/bid/56892
http://www.securityfocus.com/bid/56896
http://www.securityfocus.com/bid/56898
CVE Name
CVE-2012-5676
CVE-2012-5677
CVE-2012-5678
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|