86046 : Adobe Flash Player / AIR Unspecified Memory Corruption (2012-5269)
Printer | http://osvdb.org/86046 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
14	307	8 months ago	6 days ago	1 times	100%

Timeline

Disclosure Date
2012-10-08

Description

A memory corruption flaw exists in Adobe Flash Player and AIR. The programs fail to sanitize certain unspecified user-supplied input, resulting in memory corruption. Through unspecified means, a context-dependent attacker can potentially execute arbitrary code.

Classification

Location: Context Dependent
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Unknown
Disclosure: Vendor Verified, Coordinated Disclosure

Solution

For Adobe Flash Player, for Windows and Mac, upgrade to version 11.4.402.287 or 10.3.183.29 or higher. For Linux, version 10.3.183.29 or 11.2.202.243 or higher. For Android, 11.1.115.20 or higher for 4.x and 11.1.111.19 or higher for 3.x, as they have been reported to fix this vulnerability. For AIR, upgrade to version 3.4.0.2710 or higher. An upgrade is required as there are no known workarounds.

Products

Adobe Systems Incorporated	Flash Player	11.4.402.278
		11.4.402.265
		11.2.202.238
		11.1.115.17
		11.1.111.16
	AIR	3.4.0.2540
		3.4.0.2540 SDK

References

Security Tracker: 1027624
CVE ID: 2012-5269 (see also: NVD)
Microsoft Knowledge Base Article: 2758994
Secunia Advisory ID: 50820 50870 50872 50876 52444 53453
Related OSVDB ID: 86025 86026 86027 86028 86029 86030 86031 86032 86033 86034 86035 86036 86037 86038 86039 86040 86041 86042 86043 86044 86045 86047 86048 86049
Vendor Specific News/Changelog Entry: http://googlechromereleases.blogspot.dk/2012/10/stable-channel-update.html
http://lists.opensuse.org/opensuse-updates/2012-10/msg00042.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00082.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00084.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00086.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00090.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00091.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00092.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00094.html
http://lists.opensuse.org/opensuse-updates/2013-02/msg00096.html
Vendor Specific Advisory URL: http://technet.microsoft.com/en-us/security/advisory/2755801
http://www.adobe.com/support/security/bulletins/apsb12-22.html
http://www.blackberry.com/btsc/KB34161
RedHat RHSA: RHSA-2012:1346

Credit

CVSSv2 Score

CVSSv2 Base Score = 10.0
Source: nvd.nist.gov | Generated: 2012-10-09 | Disagree?

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.