Buffer overflow in Adobe Air
CVE-2011-2140
Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1.1961 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2135, CVE-2011-2417, and CVE-2011-2425.
Vulnerability class: Buffer Overflow
EPSS: 0.823 (99.6th percentile) — read the EPSS interpretation.
Affected products
- Adobe Adobe_air — versions 1.0, 1.1, 1.5
- Adobe Flash_player — versions 6.0.21.0, 6.0.79, 7.0
- Apple Mac_os_x
- Google Android
- Linux Linux_kernel
- Microsoft Windows
- Sun Sunos
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@adobe.com (vendor-advisory, x_refsource_SUSE)
- psirt@adobe.com (signature, x_refsource_OVAL, vdb-entry)
- psirt@adobe.com (x_refsource_SECUNIA, third-party-advisory)
- psirt@adobe.com (US Government Resource, x_refsource_CERT, third-party-advisory)
- psirt@adobe.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
- psirt@adobe.com (vendor-advisory, x_refsource_SUSE)
- psirt@adobe.com (x_refsource_REDHAT, vendor-advisory)
- psirt@adobe.com (vendor-advisory, x_refsource_SUSE)
Frequently asked questions
- What is CVE-2011-2140?
- CVE-2011-2140 is a vulnerability in Adobe Air, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2011-08-10.
- Is CVE-2011-2140 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.