Intelligence online17 sources monitored8 actively exploited 7d26 published 24hChecked recently
Vulnerability record

CVE-2011-0609

Adobe Flash Player Unspecified Vulnerability

HighExploitation confirmedCISA KEV
What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Flash Player, fix it now.

CISA required action: The impacted product is end-of-life and should be disconnected if still in use.

US federal civilian agencies must remediate by Jun 22, 2022.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

Description

Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

ProductVendorAffected versionsFixed inSource
AcrobatAdobe>= 9.0, <= 9.4.2; 10.0; 10.0.1—NVD
ChromeGoogle< 10.0.648.13410.0.648.134NVD
Flash PlayerAdobe<= 10.2.154.13; <= 10.1.106.16—KEV

Sources: NVD = NIST National Vulnerability Database; KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdateKEV

    CVE-2011-0609 scored CVSS 7.8: Adobe Flash Player, Adobe Flash Player Unspecified Vulnerability

    CISA lists this as exploited in the wild. Unpatched Flash Player systems are exposed to active attacks now.

    Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References