Adobe Flash Player Memory Corruption Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-28

[ Description ]Official description

Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.

CISA: Adobe Flash Player contains a memory corruption vulnerability that allows for remote code execution or denial-of-service (DoS).

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 18 Apr 2022): The impacted product is end-of-life and should be disconnected if still in use.

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• lists.opensuse.org/opensuse-security-announce/2012-06/msg00006.htmlMailing ListThird Party Advisory
• lists.opensuse.org/opensuse-security-announce/2012-06/msg00007.htmlMailing ListThird Party Advisory
• rhn.redhat.com/errata/RHSA-2012-0722.htmlThird Party Advisory
• www.adobe.com/support/security/bulletins/apsb12-14.htmlVendor Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource