CVE-2012-0767 Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and be...
MediumCVSS 6.1
EPSS 6.2%
CISA KEV
added 2022-06-08 · due 2022-06-22
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.
CISA Known Exploited Vulnerability
- Date added
- 2022-06-08
- Due date (FCEB)
- 2022-06-22
- Ransomware use
- Unknown
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe flash player | < 10.3.183.15 | 10.3.183.15 |
| Adobe flash player | >= 11.0, < 11.1.102.62 | 11.1.102.62 |
| Adobe flash player | < 11.1.111.6 | 11.1.111.6 |
| Adobe flash player | < 11.1.115.6 | 11.1.115.6 |
References
- openSUSE-SU-2012:0265 broken-link vendor-advisory
- RHSA-2012:0144 third-party-advisory vendor-advisory
- 48265 broken-link third-party-advisory
- 48819 broken-link third-party-advisory
- GLSA-201204-07 third-party-advisory vendor-advisory
- www.adobe.com broken-link patch vendor-advisory
- oval:org.mitre.oval:def:14806 signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:15933 signature third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource