National Cyber Awareness System

Vulnerability Summary for CVE-2011-0611

Overview

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Vulnerability Note: VU#230057

Name: VU#230057

Hyperlink:http://www.kb.cert.org/vuls/id/230057

External Source: XF

Name: adobe-flash-swf-doc-ce(66681)

Hyperlink:http://xforce.iss.net/xforce/xfdb/66681

External Source: VUPEN

Name: ADV-2011-0924

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2011/0924

External Source: VUPEN

Name: ADV-2011-0923

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2011/0923

External Source: VUPEN

Name: ADV-2011-0922

Type: Advisory

Hyperlink:http://www.vupen.com/english/advisories/2011/0922

External Source: SECTRACK

Name: 1025325

Hyperlink:http://www.securitytracker.com/id?1025325

External Source: SECTRACK

Name: 1025324

Hyperlink:http://www.securitytracker.com/id?1025324

External Source: BID

Name: 47314

Hyperlink:http://www.securityfocus.com/bid/47314

External Source: REDHAT

Name: RHSA-2011:0451

Type: Advisory

Hyperlink:http://www.redhat.com/support/errata/RHSA-2011-0451.html

External Source: EXPLOIT-DB

Name: 17175

Hyperlink:http://www.exploit-db.com/exploits/17175

External Source: CONFIRM

Name: http://www.adobe.com/support/security/bulletins/apsb11-08.html

Hyperlink:http://www.adobe.com/support/security/bulletins/apsb11-08.html

External Source: CONFIRM

Name: http://www.adobe.com/support/security/bulletins/apsb11-07.html

Type: Advisory

Hyperlink:http://www.adobe.com/support/security/bulletins/apsb11-07.html

External Source: CONFIRM

Name: http://www.adobe.com/support/security/advisories/apsa11-02.html

Type: Advisory

Hyperlink:http://www.adobe.com/support/security/advisories/apsa11-02.html

External Source: SREASON

Name: 8292

Hyperlink:http://securityreason.com/securityalert/8292

External Source: SREASON

Name: 8204

Hyperlink:http://securityreason.com/securityalert/8204

External Source: MISC

Name: http://secunia.com/blog/210/

Type: Advisory

Hyperlink:http://secunia.com/blog/210/

External Source: SECUNIA

Name: 44149

Type: Advisory

Hyperlink:http://secunia.com/advisories/44149

External Source: SECUNIA

Name: 44141

Type: Advisory

Hyperlink:http://secunia.com/advisories/44141

External Source: SECUNIA

Name: 44119

Type: Advisory

Hyperlink:http://secunia.com/advisories/44119

External Source: OVAL

Name: oval:org.mitre.oval:def:14175

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:14175

External Source: SUSE

Name: SUSE-SA:2011:018

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00004.html

External Source: CONFIRM

Name: http://googlechromereleases.blogspot.com/2011/04/stable-channel-update.html

Hyperlink:http://googlechromereleases.blogspot.com/2011/04/stable-channel-update.html

External Source: MISC

Name: http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html

Hyperlink:http://contagiodump.blogspot.com/2011/04/apr-8-cve-2011-0611-flash-player-zero.html

External Source: MISC

Name: http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html

Hyperlink:http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html

External Source: MISC

Name: http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx

Hyperlink:http://blogs.technet.com/b/mmpc/archive/2011/04/12/analysis-of-the-cve-2011-0611-adobe-flash-player-vulnerability-exploitation.aspx

References to Check Content

Identifier:oval:org.mitre.oval:def:14175

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:14175