{"schemaVersion":3,"id":"CVE-2011-0609","aliases":["RHSA-2011:0372"],"status":"published","duplicateOf":null,"title":"Adobe Flash Player Unspecified Vulnerability","description":"Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader and Acrobat 9.x through 9.4.2 and 10.x through 10.0.1 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content, as demonstrated by a .swf file embedded in an Excel spreadsheet, and as exploited in the wild in March 2011.","dates":{"published":"2011-03-15T17:00:00.000Z","modified":"2025-10-22T00:05:49.973Z","reserved":null,"kevAdded":["2022-06-08T00:00:00.000Z"],"kevDue":["2022-06-22T00:00:00.000Z"]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.63507,"percentile":0.99208,"severity":"critical","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":-3.3139999999999947,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.66821},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.63507,"percentile":0.99208}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.66821,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.63507,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.63507,"percentile":0.99208}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-06-08T00:00:00.000Z","dueDate":"2022-06-22T00:00:00.000Z","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","name":"Adobe Flash Player Unspecified Vulnerability","description":"Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2011-0609","label":"nvd.nist.gov/vuln/detail/CVE-2011-0609"}],"vendor":"Adobe","product":"Flash Player","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-06-08T00:00:00.000Z","dueDate":"2022-06-22T00:00:00.000Z","requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","name":"Adobe Flash Player Unspecified Vulnerability","description":"Adobe Flash Player contains an unspecified vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2011-0609","label":"nvd.nist.gov/vuln/detail/CVE-2011-0609"}],"vendor":"Adobe","product":"Flash Player","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"17027","name":"Adobe Flash Player - AVM Bytecode Verification (Metasploit)","source":"exploit-database","url":"https://www.exploit-db.com/exploits/17027","maturity":"weaponized","reliabilityScore":0.8,"verified":true,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"remote","platform":"windows","file":"exploits/windows/remote/17027.rb","codes":["CVE-2011-0609"]},"metasploit":null},{"id":"MSF_EXPLOIT_WINDOWS_BROWSER_ADOBE_FLASHPLAYER_AVM","name":"Adobe Flash Player AVM Bytecode Verification Vulnerability","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/windows/browser/adobe_flashplayer_avm.rb","maturity":"weaponized","reliabilityScore":0.6666666666666666,"verified":true,"type":"remote","platforms":[],"requiresAuth":false,"exploitdb":null,"metasploit":{"fullname":"exploit/windows/browser/adobe_flashplayer_avm","rank":"400","rankName":"good","postAuth":false,"check":false,"stability":["unknown-stability"],"sideEffects":["unknown-side-effects"],"reliability":["unknown-reliability"]}}],"exploitCount":2,"weaknesses":[],"affected":[{"vendor":"adobe","product":"acrobat","name":"Acrobat","label":"acrobat","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 9.0, ≤ 9.4.2","noFixRecorded":false,"fixedIn":null},{"text":"10.0","noFixRecorded":false,"fixedIn":null},{"text":"10.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 9.0, ≤ 9.4.2 | 10.0 | 10.0.1","eol":null,"hubHref":"/vendor/adobe/acrobat"},{"vendor":"adobe","product":"acrobat_reader","name":"acrobat reader","label":"acrobat_reader","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 9.0, ≤ 9.4.2","noFixRecorded":false,"fixedIn":null},{"text":"10.0","noFixRecorded":false,"fixedIn":null},{"text":"10.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 9.0, ≤ 9.4.2 | 10.0 | 10.0.1","eol":null,"hubHref":"/vendor/adobe/acrobat_reader"},{"vendor":"adobe","product":"air","name":"air","label":"air","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 2.5.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 2.5.1","eol":null,"hubHref":"/vendor/adobe/air"},{"vendor":"adobe","product":"flash_player","name":"Flash Player","label":"flash_player","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 10.2.154.13","noFixRecorded":false,"fixedIn":null},{"text":"≤ 10.1.106.16","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 10.2.154.13 | ≤ 10.1.106.16","eol":null,"hubHref":"/vendor/adobe/flash_player"},{"vendor":"google","product":"chrome","name":"Chrome","label":"chrome","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 10.0.648.134","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 10.0.648.134","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"chrome","label":"Google Chrome","category":"app"}},"hubHref":"/vendor/google/chrome"},{"vendor":"opensuse","product":"opensuse","name":"opensuse","label":"opensuse","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"11.2","noFixRecorded":false,"fixedIn":null},{"text":"11.3","noFixRecorded":false,"fixedIn":null},{"text":"11.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"11.2 | 11.3 | 11.4","eol":{"isEol":true,"eolDate":"2011-05-12T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"11.2","label":"11.2","eolFrom":"2011-05-12T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"opensuse","label":"openSUSE","category":"os"}},"hubHref":"/vendor/opensuse/opensuse"},{"vendor":"redhat","product":"flash-plugin","name":"flash-plugin","label":"flash-plugin","ecosystem":"Red Hat","cpePart":null,"purl":"pkg:rpm/redhat/flash-plugin","purlType":"rpm","versions":[{"text":"< 0:10.2.153.1-1.el5","noFixRecorded":false,"fixedIn":null},{"text":"< 0:10.2.153.1-1.el6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0:10.2.153.1-1.el5 | < 0:10.2.153.1-1.el6","eol":null,"hubHref":null},{"vendor":"suse","product":"linux_enterprise","name":"linux enterprise","label":"linux_enterprise","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"10.0:sp3","noFixRecorded":false,"fixedIn":null},{"text":"11.0:sp1","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.0:sp3 | 11.0:sp1","eol":null,"hubHref":"/vendor/suse/linux_enterprise"}],"affectedCount":8,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://www.securityfocus.com/bid/46860","label":"www.securityfocus.com/bid/46860","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"http://googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates_15.html","label":"googlechromereleases.blogspot.com/2011/03/stable-and-beta-channel-updates_15.html","hostname":"googlechromereleases.blogspot.com","tags":["X Refsource MISC","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0732","label":"www.vupen.com/english/advisories/2011/0732","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"http://www.adobe.com/support/security/advisories/apsa11-01.html","label":"www.adobe.com/support/security/advisories/apsa11-01.html","hostname":"www.adobe.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://secunia.com/advisories/43751","label":"secunia.com/advisories/43751","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14147","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14147","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2011/0656","label":"www.vupen.com/english/advisories/2011/0656","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"http://www.securitytracker.com/id?1025211","label":"www.securitytracker.com/id?1025211","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html","label":"lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/66078","label":"exchange.xforce.ibmcloud.com/vulnerabilities/66078","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF","Third Party Advisory"]},{"url":"http://www.vupen.com/english/advisories/2011/0655","label":"www.vupen.com/english/advisories/2011/0655","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"http://www.securitytracker.com/id?1025210","label":"www.securitytracker.com/id?1025210","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://secunia.com/advisories/43856","label":"secunia.com/advisories/43856","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://www.kb.cert.org/vuls/id/192052","label":"www.kb.cert.org/vuls/id/192052","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://secunia.com/advisories/43772","label":"secunia.com/advisories/43772","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb11-06.html","label":"www.adobe.com/support/security/bulletins/apsb11-06.html","hostname":"www.adobe.com","tags":["X Refsource CONFIRM","Not Applicable"]},{"url":"http://securityreason.com/securityalert/8152","label":"securityreason.com/securityalert/8152","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON","Broken Link"]},{"url":"http://www.securitytracker.com/id?1025238","label":"www.securitytracker.com/id?1025238","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Broken Link","Third Party Advisory"]},{"url":"http://blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.html","label":"blogs.adobe.com/asset/2011/03/background-on-apsa11-01-patch-schedule.html","hostname":"blogs.adobe.com","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0372.html","label":"www.redhat.com/support/errata/RHSA-2011-0372.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Broken Link"]},{"url":"http://secunia.com/advisories/43757","label":"secunia.com/advisories/43757","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Broken Link"]},{"url":"http://www.vupen.com/english/advisories/2011/0688","label":"www.vupen.com/english/advisories/2011/0688","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-0609","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2011-0609","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://access.redhat.com/errata/RHSA-2011:0372","label":"access.redhat.com/errata/RHSA-2011:0372","hostname":"access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","label":"access.redhat.com/security/updates/classification/","hostname":"access.redhat.com","tags":["ARTICLE"]},{"url":"http://www.adobe.com/support/security/bulletins/apsb11-05.html","label":"www.adobe.com/support/security/bulletins/apsb11-05.html","hostname":"www.adobe.com","tags":["ARTICLE"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=684988","label":"bugzilla.redhat.com/show_bug.cgi?id=684988","hostname":"bugzilla.redhat.com","tags":["REPORT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0372.json","label":"security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_0372.json","hostname":"security.access.redhat.com","tags":["Advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-0609","label":"access.redhat.com/security/cve/CVE-2011-0609","hostname":"access.redhat.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0609","label":"www.cve.org/CVERecord?id=CVE-2011-0609","hostname":"www.cve.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0609","label":"nvd.nist.gov/vuln/detail/CVE-2011-0609","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["ARTICLE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2011-03-15T17:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-06-08T00:00:00.000Z","label":"Added to CISA KEV","detail":"Adobe Flash Player Unspecified Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-06-22T00:00:00.000Z","label":"CISA remediation due","detail":"The impacted product is end-of-life and should be disconnected if still in use.","source":"cisa"},{"kind":"modified","date":"2025-10-22T00:05:49.973Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T13:28:37.634Z","stale":false,"partial":false}}