CVE-2012-5054: Adobe Flash Player Integer Overflow Vulnerability

CVE-2012-5054 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2022-06-08

An integer overflow vulnerability exists in the copyRawDataTo method of the Matrix3D class in Adobe Flash Player. Remote attackers can exploit this flaw via malformed arguments to execute arbitrary code on the target system.

Technologies: Adobe AIR, Adobe Flash Player. Vendors: Adobe.

Quick answers

Is CVE-2012-5054 exploited in the wild?
Yes. CVE-2012-5054 is known to be exploited in the wild, first recorded on 8 June 2022. Treat it as urgent.
How severe is CVE-2012-5054?
Critical severity, with a CVSS score of 8.8, published 8 June 2022.
Which products and versions are affected?
Adobe Flash Player before 11.4.402.265.
Is there a fix for CVE-2012-5054?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2012-5054 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2012-5054?
Check whether you run Adobe AIR or Adobe Flash Player. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • Adobe Flash Player before 11.4.402.265

Timeline

  • 2012-08-21: advisory: Adobe released security bulletin APSB12-19 addressing this issue.
  • 2022-06-08: kev added: CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog.
  • 2022-06-08: disclosed: NVD publication date.
  • 2012-09-13: other: Public exploit published on Packet Storm Security.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.