CVE-2012-0767mediumunder attackCWE-79

CVE-2012-0767

Published · Updated

Follow this CVE+ Monitor Flash Player

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 6.1epss 6.2%
from disclosure to weapon
Published on NVDFeb 16
CISA KEV+3765d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
5 products
Red Hat Enterprise Linux Desktop Supplementary (v. 5) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6)
fix ↗
Action required by CISAfederal deadline: 2022-06-22

The impacted product is end-of-life and should be disconnected if still in use.

In short

Adobe Flash Player had a vulnerability that allowed attackers to inject malicious scripts into web pages viewed by users. This could let them steal data, hijack accounts, or spread malware without users realizing it.

Technical detail

CVSS 6.1 (Medium) reflects the ability to compromise confidentiality and integrity of user sessions, though exploitation requires successful delivery via a web page.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
n/a · n/a