# MA-335.102012: MyCERT Alert - Multiple Critical Vulnerabilities in Adobe Flash Player

**Date:** 09 Oct 2012  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-335.102012  
**Advisory ID:** MA-335.102012

---

**1.0 Introduction**
Multiple critical vulnerabilities (CVE-2012-5248, CVE-2012-5249, CVE-2012-5250, CVE-2012-5251, CVE-2012-5252, CVE-2012-5253, CVE-2012-5254, CVE-2012-5255, CVE-2012-5256, CVE-2012-5257, CVE-2012-5258, CVE-2012-5259, CVE-2012-5260, CVE-2012-5261, CVE-2012-5262, CVE-2012-5263, CVE-2012-5264, CVE-2012-5265, CVE-2012-5266, CVE-2012-5267, CVE-2012-5268, CVE-2012-5269, CVE-2012-5270, CVE-2012-5271, CVE-2012-5272) have been identified in Adobe Flash Player 11.4.402.278 and earlier versions for Windows, Adobe Flash Player 11.4.402.265 and earlier versions for Macintosh, Adobe Flash Player 11.2.202.238 and earlier for versions for Linux, Adobe Flash Player 11.1.115.17 and earlier versions for Android 4.x, and Adobe Flash Player 11.1.111.16 and earlier versions for Android 3.x and 2.x.
These vulnerabilities allow a remote attacker to execute arbitrary code on a vulnerable version of Adobe Flash Player. User interaction is required where a user must visit a malicious website or opening a file which is embedded with a specially crafted SWF file. These vulnerabilities would cause the application to crash and could potentially allow attacker to take control of the affected system. [1]
**2.0 Impact**
By exploiting this vulnerability, an attacker could execute arbitrary code on vulnerable installations of Adobe Flash and gain the same privilege as the user. This vulnerability could be exploited to install malware on the user's computer.
**3.0 Affected Products**
Products listed below are vulnerable to these vulnerabilities:
- Adobe Flash Player 11.4.402.278 and earlier versions for Windows
- Adobe Flash Player 11.4.402.265 and earlier versions for Macintosh
- Adobe Flash Player 11.2.202.238 and earlier versions for Linux
- Adobe Flash Player 11.1.115.17 and earlier versions for Android 4.x
- Adobe Flash Player 11.1.111.16 and earlier versions for Android 3.x and 2.x
- Adobe AIR 3.4.0.2540 and earlier versions for Windows and Macintosh
- Adobe AIR 3.4.0.2540 SDK (includes AIR for iOS) and earlier versions
- Adobe AIR 3.4.0.2540 and earlier versions for Android
**4.0 Recommendation**
- MyCERT recommends users of Adobe Flash Player on Windows, Linux and Macintosh to upgrade to the newest version by downloading it from the following URL: <http://get.adobe.com/flashplayer/>
- Users of Adobe Flash Player 11.1.115.11 and earlier versions on Android 4.x devices should update to Adobe Flash Player11.1.115.20\*. Upgrade is available in Google Play Store
- Users of Adobe Flash Player 11.1.111.10 and earlier versions for Android 3.x and earlier versions should update to Flash Player 11.1.111.19\*. Upgrade is available in Google Play Store
- Users of Adobe AIR 3.4.0.2540 for Windows and Macintosh should update to Adobe AIR 3.4.0.2710. Please get it from: <http://get.adobe.com/air/>
- Users of the Adobe AIR 3.4.0.2540 SDK (includes AIR for iOS) should update to the Adobe AIR 3.4.0.2710SDK.
- Users of the Adobe AIR 3.4.0.2540 and earlier versions for Android should update to the Adobe AIR 3.4.0.2710. Upgrade is available in Google Play Store.
Users may also consider using a vulnerability management tool such as Secunia to ensure that all applications are updated:
- <http://secunia.com/vulnerability_scanning/personal/>
MyCERT generally advise users to keep themselves updated with the latest security announcements by the vendor. In case the public receives any suspicious URL or file, and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#ccafb5aea9bef5f5f58cafb5aea9bebfa9afb9bea5b8b5e2a1b5) or [[email protected]](/cdn-cgi/l/email-protection#ff92869c9a8d8bbf92869c9a8d8bd1908d98d19286)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT <EMAIL> <COMPLAINT> to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
i. <http://www.adobe.com/support/security/bulletins/apsb12-22.html>