CVE-2011-0609: Adobe Flash Player Unspecified Vulnerability
Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).
Other sources
Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Disconnect the impacted product (Adobe Flash Player) from networks or isolate systems if still in use. Specifically, remove network access or isolate hosts running Adobe Flash Player 10.2.154.13 and earlier (Windows, Mac OS X, Linux, Solaris), Adobe Flash Player 10.1.106.16 and earlier on Android, and Adobe AIR 2.5.1 and earlier, because the product is end-of-life.
- Compensating control
Isolate or restrict access to systems running Adobe Reader/Acrobat that contain the vulnerable Authplay component (Authplay.dll / AuthPlayLib.bundle) in versions 9.x through 9.4.2 and 10.x through 10.0.1 until a remediation is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0609?
CVE-2011-0609 is considered a critical vulnerability that may allow remote code execution or denial-of-service conditions.
How do I fix CVE-2011-0609?
The recommended fix for CVE-2011-0609 is to upgrade to the latest version of Adobe Flash Player.
What versions of Adobe Flash Player are affected by CVE-2011-0609?
CVE-2011-0609 affects Adobe Flash Player versions 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris, and 10.1.106.16 and earlier on Android.
Can CVE-2011-0609 be exploited remotely?
Yes, CVE-2011-0609 can be exploited remotely, allowing attackers to execute arbitrary code or cause a denial of service.
Is there a specific platform where CVE-2011-0609 is vulnerable?
CVE-2011-0609 is vulnerable across multiple platforms including Windows, Mac OS X, Linux, and Android.