SB2012021501 - Multiple vulnerabilities in Adobe Flash Player
Published: February 15, 2012 Updated: March 14, 2017
Security Bulletin ID
SB2012021501
Severity
High
Patch available
YES
Number of vulnerabilities
6
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2012-0767)
The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.The vulnerability exists due to insufficient sanitization of user-input.A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user’s browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Note: the vulnerability was being actively exploited.
2) Memory corruption (CVE-ID: CVE-2012-0755)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to unspecified security bypass error when processing .swf content. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, bypass certain security restrictions and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
3) Memory corruption (CVE-ID: CVE-2012-0754)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
4) Memory corruption (CVE-ID: CVE-2012-0753)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to boundary error when parsing a malicious MP4 content .swf files. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
5) Type confusion (CVE-ID: CVE-2012-0752)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to type confusion error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
6) Memory corruption (CVE-ID: CVE-2012-0751)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to boundary error within Windows ActiveX control when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into viewing it, trigger memory corruption and execute arbitrary code with privileges of the current user.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Remediation
Install update from vendor's website.