CVE-2012-5279

Vulnerability

Adobe Flash Player and Adobe AIR contain a memory corruption vulnerability that can be triggered via unspecified vectors. Affected versions include Flash Player before 10.3.183.43 and 11.x before 11.5.502.110 on Windows and Mac OS X, before 10.3.183.43 and 11.x before 11.2.202.251 on Linux, before 11.1.111.24 on Android 2.x and 3.x, and before 11.1.115.27 on Android 4.x. Adobe AIR before 3.5.0.600 and Adobe AIR SDK before 3.5.0.600 are also affected. The vulnerability is reachable when a user processes crafted Flash content.

Exploitation

An attacker can exploit this vulnerability by delivering a specially crafted Flash file to a target user, typically via a malicious website or email attachment. No authentication is required, but user interaction (e.g., opening the file or visiting a compromised site) is necessary. The unspecified vectors likely involve memory corruption during parsing or rendering of the Flash content.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the affected system with the privileges of the user running Flash Player or AIR. Alternatively, an attacker could cause a denial of service (application crash). This can lead to full compromise of the user's data and system.

Mitigation

Adobe released fixed versions: Flash Player 10.3.183.43, 11.5.502.110 (Windows/Mac), 11.2.202.251 (Linux), 11.1.111.24 (Android 2.x/3.x), 11.1.115.27 (Android 4.x); AIR 3.5.0.600; and AIR SDK 3.5.0.600. Red Hat provided updates via RHSA-2012:1431 [1]. Users should update to the latest versions as soon as possible. No workarounds are documented.