CVE-2012-5277

Vulnerability

A buffer overflow vulnerability exists in Adobe Flash Player versions before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x. Adobe AIR before 3.5.0.600 and Adobe AIR SDK before 3.5.0.600 are also affected. The vulnerability can be triggered via unspecified vectors [1].

Exploitation

An attacker can exploit this vulnerability by providing malicious content that triggers the buffer overflow. The exact attack vector is not disclosed, but common Flash Player attack vectors include specially crafted SWF files or web pages. No authentication or user interaction beyond normal browsing may be required [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the affected application, potentially leading to complete compromise of the user's system [1].

Mitigation

Adobe has released updates to address this vulnerability: Flash Player 10.3.183.43 and 11.5.502.110 for Windows/Mac, 11.2.202.251 for Linux, and appropriate versions for Android; AIR 3.5.0.600. Red Hat provides updated flash-plugin packages via RHSA-2012:1431 [1]. Users should apply updates as soon as possible.