High severity · published Apr 13, 2011
CVE-2011-0611
Adobe Flash Player Remote Code Execution Vulnerability
In wildKEV
8.8
CVSS
99.4%
EPSS
Yes
On KEV
Description
Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)99.4% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Mar 3, 2022
Federal remediation dueMar 24, 2022
Ransomware campaign useNot known
Affected products
Which versions
CH
Chrome · Google
before 10.0.648.205 · source: NVD
AC
Acrobat · Adobe
9.0 before 9.4; 10.0 before 10.0.3 · source: NVD, CISA
AR
Acrobat Reader · Adobe
9.0 before 9.4.4; 10.0 through 10.0.1; 9.0 before 9.4.4; 10.0 before 10.0.3 · source: NVD
AA
Adobe Air · Adobe
before 2.6.19140 · source: NVD
FP
Flash Player · Adobe
before 10.2.154.27; through 10.2.156.12 · source: NVD, CISA, KEV
LE
Linux Enterprise Desktop · Suse
10; 11 · source: NVD
OP
Opensuse · Opensuse
11.2; 11.3; 11.4 · source: NVD
AI
Air · Adobe
before 2.6.19140 · source: CISA
RE
Reader · Adobe
9.0 before 9.4.4; 10.0 before 10.0.3 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0611
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
http://bugix-security.blogspot.com/2011/04/cve-2011-0611-adobe-flash-zero-day.html
vdb-entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14175
vdb-entry
http://www.securityfocus.com/bid/47314
x_refsource_MISC
http://secunia.com/blog/210/
third-party-advisory
http://securityreason.com/securityalert/8204
vdb-entry
http://www.vupen.com/english/advisories/2011/0922
More from Chrome
9.8
CVE-2025-10585
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2014-0497
Adobe Flash Player Integer Underflow Vulnerablity
9.6
CVE-2024-7971
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-5274
Google Chromium V8 Type Confusion Vulnerability
9.6
CVE-2024-4947
Google Chromium V8 Type Confusion Vulnerability