CVE-2012-0767

Adobe Flash Player Cross-Site Scripting (XSS)

6.1 MEDIUMActively exploited (CISA KEV)EPSS 6.19%

Published16 Feb 2012
Added to CISA KEV8 Jun 2022
Remediation due22 Jun 2022

Description

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeChanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Adobe Flash Player≥ 11.0 < 11.1.102.62 · < 10.3.183.15 · < 11.1.111.6 · < 11.1.115.6

Remediation

Fixed in

Adobe Flash Player≥ 11.1.102.62

Patch & vendor advisories

http://www.adobe.com/support/security/bulletins/apsb12-03.html

References

http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.htmlBroken Link
http://rhn.redhat.com/errata/RHSA-2012-0144.htmlThird Party Advisory
http://secunia.com/advisories/48265Broken Link
http://secunia.com/advisories/48819Broken Link
http://security.gentoo.org/glsa/glsa-201204-07.xmlThird Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14806Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15933Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0767US Government Resource
http://www.adobe.com/support/security/bulletins/apsb12-03.htmlBroken LinkPatchVendor Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2012-0767 being actively exploited?

Yes. CVE-2012-0767 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 8 Jun 2022.

How severe is CVE-2012-0767?

CVE-2012-0767 has a CVSS 3.1 base score of 6.1, rated medium. EPSS estimates a 6.19% probability of exploitation.

Which products are affected by CVE-2012-0767?

Affected products include Adobe Flash Player.

How do I fix CVE-2012-0767?

Upgrade affected software to a fixed version, for example Adobe Flash Player 11.1.102.62 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2012-0767 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.