Actively exploited · Published Aug 15, 2012 · Assigned by mitre
CVE-2012-1535
High 7.8 Exploited
In plain English
A high-severity code injection in Flash Player from Adobe. Attackers are actively exploiting it in the wild (listed by CISA on March 3, 2022). The chance it is exploited in the next 30 days is estimated at 70.4% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. The impacted product is end-of-life and should be disconnected if still in use.
CISA guidance
The impacted product is end-of-life and should be disconnected if still in use.
Federal agencies must remediate by Mar 24, 2022.
Official description
Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.
Affected products (as reported)
Weakness: CWE-94, CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.adobe.com/support/security/bulletins/apsb12-18.html x_refsource_CONFIRM
- RHSA-2012:1203 vendor-advisory, x_refsource_REDHAT
- GLSA-201209-01 vendor-advisory, x_refsource_GENTOO
- HPSBMU02948 vendor-advisory, x_refsource_HP
- SUSE-SU-2012:1001 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2012:0996 vendor-advisory, x_refsource_SUSE
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1535 government-resource