# MA-336.102012: MyCERT Alert - Multiple Critical Vulnerabilities in Adobe Shockwave Player

**Date:** 24 Oct 2012  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-336.102012  
**Advisory ID:** MA-336.102012

---

1.0 Introduction
Multiple critical vulnerabilities (CVE-2012-4172, CVE-2012-4173, CVE-2012-4174, CVE-2012-4175, CVE-2012-4176, CVE-2012-5273) have been identified in Adobe Shockwave Player 11.6.7.637 and earlier versions for Windows and Macintosh. [1]
These vulnerabilities allow a remote attacker to execute arbitrary code on a vulnerable version of Adobe Shockwave Player. User interaction is required where a user must visit a malicious web site, which is embedded with a specially crafted SWF file. These vulnerabilities would cause the application to crash and could potentially allow an attacker to take control of the affected system.
2.0 Impact
By exploiting these vulnerabilities, an attacker could execute arbitrary code on vulnerable installations of Adobe Shockwave Player and gain the same privilege as the user. These vulnerabilities could be exploited to install malware on the user's computer.
3.0 Affected Products
- Shockwave Player 11.6.7.637 and earlier versions for Windows and Macintosh
4.0 Recommendation
MyCERT recommends users of Adobe Shockwave Player to upgrade to the latest version by downloading it from the following URL: <http://get.adobe.com/shockwave/>
MyCERT generally advise users to keep themselves updated with the latest security announcement by the vendors. In case the public receives any suspicious URL or file, and requires our further analysis, please reach us through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT   to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
5.0 References
i.    <http://www.adobe.com/support/security/bulletins/apsb12-23.html>