CVE-2012-0772

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-03-28 · updated 2026-06-16
Weakness: CWE-119

Description

An unspecified ActiveX control in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228, and AIR before 3.2.0.2070, on Windows does not properly perform URL security domain checking, which allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors.

Affected products

Adobe Air: through 3.1.0.488; 1.0, 1.0.1, 1.1, 1.5, 1.5.1, 1.5.2 (+14)
Adobe Flash Player 24.0.0.186 and earlier.: through 10.3.183.16; 2, 3, 4, 5, 6, 6.0.21.0 (+106)

References

http://osvdb.org/80706
http://secunia.com/advisories/48618
http://www.adobe.com/support/security/bulletins/apsb12-07.html
http://www.securitytracker.com/id?1026859
http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15266
http://osvdb.org/80706
http://secunia.com/advisories/48618
http://www.adobe.com/support/security/bulletins/apsb12-07.html
http://www.securitytracker.com/id?1026859
http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15266

Get alerted when CVE-2012-0772 or the next vulnerability affects your stack