低危 Adobe Flash Player/AIR远程整数溢出漏洞
CVE编号
CVE-2012-5677利用情况
暂无补丁情况
官方补丁披露时间
2012-12-13漏洞描述
Adobe Flash Player是一款Flash文件处理程序。Adobe Air是一款Adobe公司出品的跨操作系统的运行时库。Adobe Flash Player/AIR存在一个未明整数溢出漏洞。允许攻击者构建恶意WEB页，诱使用户解析，可以应用程序上下文执行任意代码。解决建议
如下产品已经修复此漏洞，建议用户下载更新：Windows平台下的Adobe Flash Player 11.5.502.135：http://www.adobe.com/go/getflashMacintosh平台下的Adobe Flash Player 11.5.502.136http://www.adobe.com/go/getflashWindows平台下(网络分发)的Adobe Flash Player 11.5.502.135http://www.adobe.com/licensing/distributionMacintosh平台下(网络分发)的Adobe Flash Player 11.5.502.136http://www.adobe.com/licensing/distributionLinux平台下的Adobe Flash Player 11.2.202.258http://www.adobe.com/go/getflashAndroid 4.x平台下的Adobe Flash Player 11.1.115.34仅使用于安装了2012年至8月15日之前的FlashPlayer的Android 4.x设备。Android 3.x和2.x平台下的Adobe Flash Player 11.1.111.29更新已经安装了2012年至8月15日之前FlashPlayer的设备。Chrome 用户Flash Player 11.5.31.5及之前版本(Windows, Macintosh and Linux)http://googlechromereleases.blogspot.com/Windows 8 Internet Explorer 10下的Flash Player 11.3.377.15：http://support.microsoft.com/kb/2755399Windows平台下的Adobe AIR 3.5.0.880http://get.adobe.com/air/Macintosh平台下Adobe AIR 3.5.0.890http://get.adobe.com/air/Adobe AIR 3.5.0.880 SDK (Windows)http://www.adobe.com/devnet/air/air-sdk-download.htmlAdobe AIR 3.5.0.890 SDK (Macintosh)http://www.adobe.com/devnet/air/air-sdk-download.htmlAndroid平台下的Adobe AIR 3.5.0.880http://www.amazon.com/Adobe-Systems-AIR/dp/B004SRNH10/ref=sr_1_6?ie=UTF8受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | adobe | air | * | Up to (excluding) 3.5.0.880 | |||||
| 运行在以下环境 | |||||||||
| 应用 | adobe | air | * | Up to (excluding) 3.5.0.890 | |||||
| 运行在以下环境 | |||||||||
| 应用 | adobe | air_sdk | * | Up to (excluding) 3.5.0.880 | |||||
| 运行在以下环境 | |||||||||
| 应用 | adobe | air_sdk | * | Up to (excluding) 3.5.0.890 | |||||
| 运行在以下环境 | |||||||||
| 应用 | adobe | flash_player | * | From (including) 10.3 | Up to (excluding) 10.3.183.48 | ||||
| 运行在以下环境 | |||||||||
| 应用 | adobe | flash_player | * | From (including) 11.1 | Up to (excluding) 11.1.111.29 | ||||
| 运行在以下环境 | |||||||||
| 应用 | adobe | flash_player | * | From (including) 11.1 | Up to (excluding) 11.1.115.34 | ||||
| 运行在以下环境 | |||||||||
| 应用 | adobe | flash_player | * | From (including) 11.2 | Up to (excluding) 11.2.202.258 | ||||
| 运行在以下环境 | |||||||||
| 应用 | adobe | flash_player | * | From (including) 11.5 | Up to (excluding) 11.5.502.135 | ||||
| 运行在以下环境 | |||||||||
| 应用 | adobe | flash_player | * | From (including) 11.5 | Up to (excluding) 11.5.502.136 | ||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_11.4 | flash-player-gnome | * | Up to (excluding) 11.2.202.258-35.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_12.1 | flash-player-gnome | * | Up to (excluding) 11.2.202.258-38.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_12.2 | flash-player-gnome | * | Up to (excluding) 11.2.202.258-1.14.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_6 | flash-plugin | * | Up to (excluding) 0:11.2.202.258-1.el6 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12 | flash-player | * | Up to (excluding) 11.2.202.406-1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_12.04.5_lts | adobe-flashplugin | * | Up to (excluding) 11.2.202.258-0precise1 | |||||
- 攻击路径 本地
- 攻击复杂度 困难
- 权限要求 普通权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 -
| CWE-ID | 漏洞类型 |
| CWE-189 | 数值错误 |
Exp相关链接
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论