CVE-2012-2034highunder attackCWE-119

CVE-2012-2034

Published · Updated

Follow this CVE+ Monitor Flash Player

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

51Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 7.5epss 7.7%
from disclosure to weapon
Published on NVDJun 9
CISA KEV+3579d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
5 products
Red Hat Enterprise Linux Desktop Supplementary (v. 5) · Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 5) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6)
fix ↗
Action required by CISAfederal deadline: 2022-04-18

The impacted product is end-of-life and should be disconnected if still in use.

In short

Adobe Flash Player and AIR had a memory corruption vulnerability that could allow attackers to run malicious code or crash the application through unspecified methods. Updating to the patched version was critical as Flash was widely used in browsers.

Technical detail

CWE-119 memory corruption vulnerability in Adobe Flash Player and AIR across multiple platforms (Windows, macOS, Linux, Android) exploitable through unspecified vectors without known preconditions, resulting in arbitrary code execution or denial of service with CVSS 7.5 severity.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.3610, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2037.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a