CVE-2012-0767

KEVAdobe Flash Player Cross-Site Scripting (XSS) Vulnerability

Description

Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML.

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

PublishedFeb 16, 2012

Last modifiedJun 16, 2026

Added to KEVJun 8, 2022

Remediation dueJun 22, 2022

References

lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.htmlBroken Link
rhn.redhat.com/errata/RHSA-2012-0144.htmlThird Party Advisory
secunia.com/advisories/48265Broken Link
secunia.com/advisories/48819Broken Link
security.gentoo.org/glsa/glsa-201204-07.xmlThird Party Advisory
adobe.com/support/security/bulletins/apsb12-03.htmlBroken LinkPatch
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14806Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15933Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0767US Government Resource

0 recent articles mention this CVE

Risk assessment · High

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1588 days
CVSS: 6.1 MEDIUM
EPSS (30-day exploit probability): 6.2% · top 7% of all CVEs
Weakness: CWE-79
Attack vector: Network, remotely reachable

Recommended actions

1.The impacted product is end-of-life and should be disconnected if still in use.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.