CVE-2011-0611

critical-risk
Published 2011-04-13

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

Do I need to act?

!
93.7% chance of exploitation in next 30 days
EPSS score — higher than 6% of all CVEs
!
CISA KEV: actively exploited in the wild
On the Known Exploited Vulnerabilities catalog — federal agencies must patch
!
2 public exploits available
17473, 17175
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (10)

Affected Vendors

Adobe Suse Google Opensuse

References (51)

Not Applicable http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611...
Exploit http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.ht...
Exploit http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.h...
Release Notes http://googlechromereleases.blogspot.com/2011/04/stable-channel-update.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00004.html
Broken Link http://secunia.com/advisories/44119
Broken Link http://secunia.com/advisories/44141
Broken Link http://secunia.com/advisories/44149
Broken Link http://secunia.com/blog/210/
Third Party Advisory http://securityreason.com/securityalert/8204
Third Party Advisory http://securityreason.com/securityalert/8292
Broken Link http://www.adobe.com/support/security/advisories/apsa11-02.html
Broken Link http://www.adobe.com/support/security/bulletins/apsb11-07.html
Broken Link http://www.adobe.com/support/security/bulletins/apsb11-08.html
Exploit http://www.exploit-db.com/exploits/17175
Broken Link http://www.kb.cert.org/vuls/id/230057
Broken Link http://www.redhat.com/support/errata/RHSA-2011-0451.html
Broken Link http://www.securityfocus.com/bid/47314
Broken Link http://www.securitytracker.com/id?1025324
Broken Link http://www.securitytracker.com/id?1025325
and 31 more references
80
/ 100
critical-risk
Severity 30/34 · Critical
Exploitability 34/34 · Critical
Exposure 16/34 · Moderate