CVE-2012-0755

Vulnerability

Adobe Flash Player before version 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x contains an unspecified vulnerability that allows attackers to bypass intended access restrictions [1][2]. The exact nature of the bypass is not disclosed, but it can be triggered via specially crafted SWF files.

Exploitation

An attacker can exploit this vulnerability by enticing a user to open a maliciously crafted SWF file [2]. No authentication or special network position is required; the attack relies on user interaction. The unspecified vectors are not detailed in public sources, but the exploit likely involves the Flash Player processing the SWF in a way that circumvents security controls.

Impact

Successful exploitation allows an attacker to bypass intended access restrictions, potentially leading to disclosure of sensitive information or further compromise of the affected system [1][2]. The specific outcome depends on the context, but the bypass could enable cross-domain requests or escalate privileges within the Flash runtime.

Mitigation

Users should upgrade Adobe Flash Player to the fixed versions: 10.3.183.15, 11.1.102.62 (desktop), 11.1.111.6 (Android 2.x/3.x), or 11.1.115.6 (Android 4.x) [1]. Distributions such as Red Hat and Gentoo have provided updates [1][2]. No workaround is known if the upgrade cannot be applied.