CVE-2012-0767: Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.
Other sources
Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adobe Flash Player (10.x)to a version that resolves this vulnerability.Fixed in 10.3.183.15 - Upgrade
Upgrade
Adobe Flash Player (11.x)to a version that resolves this vulnerability.Fixed in 11.1.102.62 - Upgrade
Upgrade
Adobe Flash Player (Android 2.x/3.x)to a version that resolves this vulnerability.Fixed in 11.1.111.6 - Upgrade
Upgrade
Adobe Flash Player (Android 4.x)to a version that resolves this vulnerability.Fixed in 11.1.115.6 - Compensating control
Disconnect or isolate systems running the impacted Adobe Flash Player (end-of-life) from networks if still in use; block Flash content delivery to those systems at network edges (firewall/proxy) until they are remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0767?
CVE-2012-0767 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2012-0767?
To fix CVE-2012-0767, update Adobe Flash Player to versions 10.3.183.15 or 11.1.102.62 and higher.
Which software is affected by CVE-2012-0767?
CVE-2012-0767 affects Adobe Flash Player versions prior to 10.3.183.15 and 11.x before 11.1.102.62.
Can CVE-2012-0767 affect Android devices?
Yes, CVE-2012-0767 affects Adobe Flash Player on Android versions 2.x, 3.x, and 4.x before specific updates.
What are the implications of CVE-2012-0767?
The implications of CVE-2012-0767 include the potential for attackers to inject arbitrary web scripts into the browser.