CVE-2011-2092 Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX....
HighCVSS 10.0
EPSS 6.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Adobe LiveCycle Data Services 3.1 and earlier, LiveCycle 9.0.0.2 and earlier, and BlazeDS 4.0.1 and earlier do not properly restrict creation of classes during deserialization of (1) AMF and (2) AMFX data, which allows attackers to have an unspecified impact via unknown vectors, related to a "deserialization vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe blazeds | <= 4.0.1 | No fix listed |
| Adobe livecycle data services | <= 3.1 | No fix listed |
| Adobe livecycle data services | = 2.5 | No fix listed |
| Adobe livecycle data services | = 2.5.1 | No fix listed |
| Adobe livecycle data services | = 2.6 | No fix listed |
| Adobe livecycle data services | = 2.6.1 | No fix listed |
| Adobe livecycle data services | = 3 | No fix listed |
| Adobe livecycle | <= 9.0.0.2 | No fix listed |
| Adobe livecycle | = 6.0 | No fix listed |
| Adobe livecycle | = 7.0 | No fix listed |
| Adobe livecycle | = 8.0.1 | No fix listed |
| Adobe livecycle | = 8.0.1.1 | No fix listed |
| Adobe livecycle | = 8.0.1.2 | No fix listed |
| Adobe livecycle | = 8.2.1.3 | No fix listed |
References
- www.adobe.com patch vendor-advisory
- 1025656 vdb-entry
- 1025657 vdb-entry