CveMateVulnerability intelligence

CVE-2011-0609: Adobe Flash Player Unspecified Vulnerability

CVSS: 9.3v2.0HighKEVAnalyzed

AliasesRHSA-2011:0372

Published 15-03-2011Last modified 22-10-2025

Vulnerability summary

CVE-2011-0609 is a high (CVSS 9.3) vulnerability in Adobe Flash Player. It is known to be exploited: CISA lists it, first on 08-06-2022. EPSS estimates a 63.51% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

85/100

0100

Critical · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

63.51%

0%100%

Critical · -3.31 pp in 30 days

KEVListedCISA

RansomwareNone recordedNo known use recorded

Public exploits2exploit-database, metasploit

Timeline

15-03-2011
PublishedVulnerability first disclosed.
08-06-2022
Added to CISA KEVAdobe Flash Player Unspecified Vulnerability
22-06-2022
CISA remediation dueThe impacted product is end-of-life and should be disconnected if still in use.
22-10-2025
Last modifiedVulnerability information updated.

Description

Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.17.8v2.09.3

EPSS trend

Probability

63.51%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

-3.31 pp

From 66.82% on 20-09-2026

20-09-202620-10-2026

EPSS score

63.51%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 08-06-2022
Federal due date: 22-06-2022

CISA required action

The impacted product is end-of-life and should be disconnected if still in use. nvd.nist.gov/vuln/detail/CVE-2011-0609

Public exploits

2 found

exploit-databaseremotewindowsVerified
Adobe Flash Player - AVM Bytecode Verification (Metasploit)
Maturity: weaponized
MetasploitremoteVerified
Adobe Flash Player AVM Bytecode Verification Vulnerability
exploit/windows/browser/adobe_flashplayer_avm
Maturity: weaponized

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Adobe4 products

acrobat≥ 9.0, ≤ 9.4.2 | 10.0 | 10.0.1
acrobat_reader≥ 9.0, ≤ 9.4.2 | 10.0 | 10.0.1
air≤ 2.5.1
flash_player≤ 10.2.154.13 | ≤ 10.1.106.16

Google1 product

chrome< 10.0.648.134

Opensuse1 product

opensuseEOL11.2 | 11.3 | 11.4

Redhat1 product

flash-plugin< 0:10.2.153.1-1.el5 | < 0:10.2.153.1-1.el6

Suse1 product

linux_enterprise10.0:sp3 | 11.0:sp1

5 vendors · 8 products

References

32 links

www.securityfocus.com/bid/46860VDB EntryX Refsource BIDBroken LinkThird Party Advisory
googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates_15.htmlX Refsource MISCThird Party Advisory
www.vupen.com/english/advisories/2011/0732VDB EntryX Refsource VUPENBroken Link
www.adobe.com/support/security/advisories/apsa11-01.htmlX Refsource CONFIRMVendor Advisory
secunia.com/advisories/43751Third Party AdvisoryX Refsource SECUNIABroken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14147VDB EntrySignatureX Refsource OVALBroken Link
www.vupen.com/english/advisories/2011/0656VDB EntryX Refsource VUPENBroken Link
www.securitytracker.com/id?1025211VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/66078VDB EntryX Refsource XFThird Party Advisory

Show all 32 references

www.vupen.com/english/advisories/2011/0655VDB EntryX Refsource VUPENBroken Link
www.securitytracker.com/id?1025210VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
secunia.com/advisories/43856Third Party AdvisoryX Refsource SECUNIABroken Link
www.kb.cert.org/vuls/id/192052Third Party AdvisoryX Refsource CERT VNUS Government Resource
secunia.com/advisories/43772Third Party AdvisoryX Refsource SECUNIABroken Link
www.adobe.com/support/security/bulletins/apsb11-06.htmlX Refsource CONFIRMNot Applicable
securityreason.com/securityalert/8152Third Party AdvisoryX Refsource SREASONBroken Link
www.securitytracker.com/id?1025238VDB EntryX Refsource SECTRACKBroken LinkThird Party Advisory
blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.htmlX Refsource CONFIRMBroken Link
www.redhat.com/support/errata/RHSA-2011-0372.htmlVendor AdvisoryX Refsource REDHATBroken Link
secunia.com/advisories/43757Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2011/0688VDB EntryX Refsource VUPENBroken Link
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-0609Government ResourceUS Government Resource
access.redhat.com/errata/RHSA-2011:0372Advisory
access.redhat.com/security/updates/classification/ARTICLE
www.adobe.com/support/security/bulletins/apsb11-05.htmlARTICLE
bugzilla.redhat.com/show_bug.cgi?id=684988REPORT
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0372.jsonAdvisory
access.redhat.com/security/cve/CVE-2011-0609REPORT
www.cve.org/CVERecord?id=CVE-2011-0609Advisory
nvd.nist.gov/vuln/detail/CVE-2011-0609Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalogARTICLE