CVE-2011-2444
Description
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to a "universal cross-site scripting issue," as exploited in the wild in September 2011.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Adobe Flash Player before 10.3.183.10 on desktop and 10.3.186.7 on Android is vulnerable to universal XSS via crafted URLs, exploited in the wild in September 2011.
Vulnerability
A cross-site scripting (XSS) vulnerability exists in Adobe Flash Player versions before 10.3.183.10 on Windows, Mac OS X, Linux, and Solaris, and before 10.3.186.7 on Android. The issue is described as a "universal cross-site scripting issue" where a crafted URL can inject arbitrary web script or HTML [1]. This affects the way Flash Player handles certain URL inputs.
Exploitation
An attacker can exploit this vulnerability by convincing a user to click on a specially crafted URL. No further user interaction beyond clicking the link is required; the injected script or HTML executes in the context of the user's session with the affected Flash Player [1]. The exploit was observed in the wild in September 2011.
Impact
Successful exploitation allows remote attackers to inject arbitrary web script or HTML, leading to information disclosure, session hijacking, or other actions that the victim can perform. The attack can be executed across different origins due to its "universal" nature, meaning it is not limited to same-origin policy constraints [1].
Mitigation
Adobe released fixed versions: 10.3.183.10 for desktop platforms and 10.3.186.7 for Android users. Red Hat also provided updated packages via RHSA-2011:1333 [1]. Users should upgrade to the patched versions immediately. No workaround is mentioned in the available reference.
AI Insight generated on May 24, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
96cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*+ 94 more
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*range: <=10.3.183.7
- cpe:2.3:a:adobe:flash_player:10.0.0.584:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.0.12.10:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.0.12.36:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.0.15.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.0.22.87:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.0.32.18:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.0.42.34:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.0.45.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.102.64:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.105.6:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.106.16:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.52.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.52.15:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.53.64:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.82.76:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.85.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.92.10:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.92.8:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.95.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.95.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.2.152:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.2.152.32:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.2.152.33:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.2.154.13:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.2.154.25:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.2.156.12:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.2.157.51:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.2.159.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.181.14:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.181.16:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.181.23:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.181.34:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.181.36:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.183.5:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.185.21:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.185.23:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.185.25:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.3.186.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:6.0.21.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:6.0.79:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.19.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.24.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.53.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.60.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.61.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.66.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.67.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.68.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.0.73.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:8.0.22.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:8.0.33.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:8.0.42.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.125.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.151.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.152.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.155.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.159.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.18d60:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.246.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.260.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.262.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.277.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.283.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.31:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:9.125.0:*:*:*:*:*:*:*
- Range: <10.3.183.10 (desktop) / <10.3.186.7 (Android)
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- www.adobe.com/support/security/bulletins/apsb11-26.htmlnvdPatchVendor Advisory
- googlechromereleases.blogspot.com/2011/09/stable-channel-update_20.htmlnvd
- lists.opensuse.org/opensuse-security-announce/2011-09/msg00025.htmlnvd
- secunia.com/advisories/48308nvd
- www.redhat.com/support/errata/RHSA-2011-1333.htmlnvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14050nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15272nvd
News mentions
0No linked articles in our index yet.