Adobe Flash Player and AIR CVE-2012-5265 Buffer Overflow Vulnerability

Bugtraq ID:	56222
Class:	Boundary Condition Error
CVE:	CVE-2012-5265
Remote:	Yes
Local:	No
Published:	Oct 08 2012 12:00AM
Updated:	Mar 19 2015 09:19AM
Credit:	Mateusz Jurczyk, Gynvael Coldwind, and Fermin Serna from Google Security Team
Vulnerable:	SuSE SUSE Linux Enterprise Desktop 11 SP2 + Linux kernel 2.6.5 SuSE SUSE Linux Enterprise Desktop 10 SP4 + Linux kernel 2.6.5 SuSE openSUSE 12.1 SuSE openSUSE 11.4 Red Hat Enterprise Linux Workstation Supplementary 6 Red Hat Enterprise Linux Supplementary 5 server Red Hat Enterprise Linux Server Supplementary 6 Red Hat Enterprise Linux Desktop Supplementary 6 Red Hat Enterprise Linux Desktop Supplementary 5 client openSUSE openSUSE 12.2
Not Vulnerable:

Adobe Flash Player and AIR CVE-2012-5265 Buffer Overflow Vulnerability

Adobe Flash Player and AIR are prone to a remote buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the application or cause denial-of-service conditions.

NOTE: This issue was previously covered in BID 55827 (Adobe Flash Player and AIR APSB12-22 Multiple Remote Vulnerabilities) but has been given its own record to better document it.

Adobe Flash Player and AIR CVE-2012-5265 Buffer Overflow Vulnerability

References:

• Adobe AIR homepage (Adobe)
  
• Adobe Flash Homepage (Adobe)
  
• Adobe Flash Player: Multiple vulnerabilities (Gentoo)
  
• APSB12-22 : Security updates available for Adobe Flash Player (Adobe)
  
• BSRT-2013-004 Vulnerabilities in Adobe Flash Player version included with the Bl (Blackberry)
  
• openSUSE Security Update: flash-player: Update to 11.2.202.243 (openSUSE)
  
• Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10 (Microsoft)