Vulnerability CVE-2012-5285

Vulnerability Name:

CVE-2012-5285 (CCN-79770)

Assigned:

2012-10-08

Published:

2012-10-08

Updated:

2018-12-04

Summary:

Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 on Windows and Mac OS X, before 10.3.183.29 and 11.x before 11.2.202.243 on Linux, before 11.1.111.19 on Android 2.x and 3.x, and before 11.1.115.20 on Android 4.x; Adobe AIR before 3.4.0.2710; and Adobe AIR SDK before 3.4.0.2710 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22.

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-119

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2012-5285

Source: CCN
Type: Google Chrome Releases Web site
Stable Channel Update

Source: OSVDB
Type: Broken Link
86874

Source: CCN
Type: Adobe Product Security Bulletin APSB12-22
Security updates available for Adobe Flash Player

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.adobe.com/support/security/bulletins/apsb12-22.html

Source: CCN
Type: OSVDB ID: 86874
Adobe Flash Player / AIR Unspecified Overflow (2012-5285)

Source: BID
Type: Third Party Advisory, VDB Entry
56374

Source: CCN
Type: BID-56374
Adobe Flash Player and AIR CVE-2012-5285 Buffer Overflow Vulnerability

Source: XF
Type: Third Party Advisory, VDB Entry
adobe-cve20125285-bo(79770)

Source: XF
Type: UNKNOWN
adobe-cve20125285-bo(79770)

Vulnerable Configuration:

Configuration 1:

cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version >= 10.3 and < 10.3.183.29)

OR cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version >= 11.4 and < 11.4.402.287)

AND

cpe:/o:apple:mac_os_x:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version >= 10.3 and < 10.3.183.29)

OR cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version >= 11.2 and < 11.2.202.243)

AND

cpe:/o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version >= 11.1 and < 11.1.111.19)

AND

cpe:/o:google:android:*:*:*:*:*:*:*:* (Version >= 2.0 and <= 2.3.7)

OR cpe:/o:google:android:*:*:*:*:*:*:*:* (Version >= 3.0 and <= 3.2.6)

Configuration 4:

cpe:/a:adobe:flash_player:*:*:*:*:*:*:*:* (Version >= 11.1 and < 11.1.115.20)

AND

cpe:/o:google:android:*:*:*:*:*:*:*:* (Version >= 4.0 and <= 4.4.4)

Configuration 5:

cpe:/a:adobe:air:*:*:*:*:*:*:*:* (Version < 3.4.0.2710)

OR cpe:/a:adobe:air_sdk:*:*:*:*:*:*:*:* (Version < 3.4.0.2710)

Configuration RedHat 1:

cpe:/a:redhat:rhel_extras:6:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/a:redhat:rhel_extras:5:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:20963	V	Buffer overflow in Adobe Flash Player before 10.3.183.29 and 11.x before 11.4.402.287 and Adobe AIR before 3.4.0.2710 on Windows, allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than other Flash Player buffer overflow CVEs listed in APSB12-22	2015-08-03
oval:org.mitre.oval:def:21594	P	RHSA-2012:1346: flash-plugin security update (Critical)	2015-03-09
oval:org.mitre.oval:def:23588	P	ELSA-2012:1346: flash-plugin security update (Critical)	2014-07-21
oval:com.ubuntu.precise:def:20125285000	V	CVE-2012-5285 on Ubuntu 12.04 LTS (precise) - medium.	2012-11-13
oval:com.redhat.rhsa:def:20121346	P	RHSA-2012:1346: flash-plugin security update (Critical)	2012-10-09

BACK