CVE-2011-0611: Adobe Flash Player Remote Code Execution Vulnerability
Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.
Other sources
Adobe Flash Player contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adobe Flash Player (Windows, Mac OS X, Linux, Solaris)to a version that resolves this vulnerability.Fixed in 10.2.154.27 - Upgrade
Upgrade
Adobe AIRto a version that resolves this vulnerability.Fixed in 2.6.19140 - Upgrade
Upgrade
Adobe Reader 9.xto a version that resolves this vulnerability.Fixed in 9.4.4 - Upgrade
Upgrade
Adobe Reader 10.x (Mac OS X)to a version that resolves this vulnerability.Fixed in 10.0.3 - Upgrade
Upgrade
Adobe Acrobat 9.xto a version that resolves this vulnerability.Fixed in 9.4.4 - Upgrade
Upgrade
Adobe Acrobat 10.x (Windows and Mac OS X)to a version that resolves this vulnerability.Fixed in 10.0.3 - Compensating control
Disconnect the impacted product (Macromedia/Adobe Flash Player) from networks if still in use (the impacted product is end-of-life).
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0611?
The CVE-2011-0611 vulnerability is rated as critical due to its potential for remote code execution.
How can I fix CVE-2011-0611?
To fix CVE-2011-0611, users should update Adobe Flash Player and Adobe AIR to the latest versions released after the vulnerabilities were addressed.
Which Adobe products are affected by CVE-2011-0611?
CVE-2011-0611 affects Adobe Flash Player, Adobe AIR, and older versions of Adobe Acrobat Reader.
What types of attacks can exploit CVE-2011-0611?
CVE-2011-0611 can be exploited through malicious Flash content that may cause memory corruption and lead to arbitrary code execution.
When was CVE-2011-0611 disclosed?
CVE-2011-0611 was disclosed in February 2011 as part of Adobe's security updates.