CVE Vulnerability Advisory Database

[Affected Scope] Adobe Flash Player on Windows, macOS, Linux, and Adobe AIR/SDK on Android and desktop environments prior to specific patched versions

[Impact] Remote attackers can execute arbitrary code (RCE) and gain full control of the target system via crafted Flash content

[Mitigation] Upgrade to the patched versions immediately, or completely uninstall and disable Adobe Flash Player across all enterprise endpoints

[Affected Scope] Adobe Flash Player before 11.7.700.261, 11.8.x through 12.0.x before 12.0.0.44 on Windows/macOS, and before 11.2.202.336 on Linux

[Impact] Remote attackers can execute arbitrary code and gain full control of the target system by enticing users to visit a website containing a specially crafted Flash (.swf) file

[Mitigation] Immediately uninstall legacy Adobe Flash Player or upgrade to patched versions, and disable Flash execution in all web browsers

[Affected Scope] Linux kernel before version 3.5.5 running on v6k and v7 ARM platforms, including affected Android devices

[Impact] Local attackers can exploit missing address validation in get_user and put_user APIs to read or write arbitrary kernel memory, leading to full root privilege escalation

[Mitigation] Upgrade the Linux kernel to version 3.5.5 or higher, or apply the latest security patches provided by your OS/device vendor

[Affected Scope] Internet Explorer and the icardie.dll ActiveX control running on Windows XP, Vista, 7, 8, 8.1, and Windows Server 2003, 2008, 2012

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (system crash) by enticing users to visit a specially crafted malicious web page

[Mitigation] Apply the official Microsoft MS13-090 security patch or configure the ActiveX Kill Bit for the icardie.dll control via the registry

[Affected Scope] Microsoft Silverlight 5 before version 5.1.20913.0

[Impact] Remote attackers can obtain sensitive information from process memory, potentially bypassing security mitigations like ASLR to facilitate subsequent code execution

[Mitigation] Upgrade Microsoft Silverlight to version 5.1.20913.0 or later, or completely disable/uninstall the Silverlight plugin

[Affected Scope] Microsoft Internet Explorer versions 6 through 11

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user via crafted JavaScript and ms-help: protocol handlers

[Mitigation] Apply the MS13-080 cumulative security update, or implement workarounds such as disabling hxds.dll loading

[Affected Scope] Microsoft Internet Explorer (IE) versions 8, 9, and 10 running on Windows environments.

[Impact] Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the current user or cause a denial of service (memory corruption) via a crafted malicious website.

[Mitigation] Apply the official Microsoft security update (MS13-055), transition to modern secure browsers, or implement temporary workarounds such as disabling Active Scripting.

[Affected Scope] Microsoft Office 2003 SP3 and Office 2011 for Mac.

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a crafted Office document containing malicious PNG data.

[Mitigation] Apply the official MS13-051 security patch immediately, or upgrade legacy, end-of-life Office installations to a supported version.

[Affected Scope] Linux kernel versions 2.6.37 through 3.8.8

[Impact] Local unprivileged users can exploit this vulnerability via a crafted perf_event_open system call to execute arbitrary code with root privileges

[Mitigation] Upgrade the Linux kernel to version 3.8.9 or higher, or restrict unprivileged access to performance events by configuring perf_event_paranoid

[Affected Scope] Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7

[Impact] Remote attackers can bypass permission checks via MethodHandles, modify arbitrary public final fields using reflection and type confusion, and disable the Security Manager to compromise system integrity

[Mitigation] Immediately upgrade to Oracle Java SE 7 Update 21 or apply the latest OpenJDK 7 patches

[Affected Scope] Linux kernel versions before 3.8.9, including certain Android 4.1.2 builds and embedded Linux systems

[Impact] Local attackers can exploit an integer overflow to map the entire kernel memory space with read-write permissions, leading to full root privilege escalation

[Mitigation] Upgrade the Linux kernel to version 3.8.9 or higher, and restrict access permissions to framebuffer device files

[Affected Scope] Microsoft Silverlight 5 and Silverlight 5 Developer Runtime versions prior to 5.1.20125.0

[Impact] Remote attackers can execute arbitrary code with the logged-in user's privileges by enticing users to visit a website containing a specially crafted Silverlight application

[Mitigation] Upgrade Microsoft Silverlight to version 5.1.20125.0 or later, or completely uninstall the Silverlight plugin from all endpoints

[Affected Scope] Adobe Flash Player versions before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 11.2.202.273 on Linux

[Impact] Remote attackers can execute arbitrary code and gain full control of the target system by enticing users to load a specially crafted SWF file

[Mitigation] Immediately uninstall Adobe Flash Player from all endpoints and servers, or disable Flash execution within web browsers and document viewers

[Affected Scope] Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows/macOS, and before 11.2.202.273 on Linux (specifically within Firefox plugin environments)

[Impact] Remote attackers can bypass the Firefox browser sandbox and execute arbitrary code on the host system via crafted malicious SWF content

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), the recommended mitigation is to completely uninstall Flash Player from all endpoints

[Affected Scope] Oracle Java SE 7 through Update 11, and OpenJDK 7.

[Impact] Remote attackers can bypass the Java security sandbox and execute arbitrary code with elevated privileges.

[Mitigation] Apply the latest Java SE/OpenJDK security updates and disable Java browser plugins immediately.

[Affected Scope] Oracle Java 7 Update 10 and earlier versions (all versions prior to Java 7 Update 11).

[Impact] Remote attackers can completely bypass the JVM security sandbox and execute arbitrary system commands with the privileges of the running user by enticing them to visit a malicious web page containing a crafted Java applet.

[Mitigation] Immediately upgrade to Oracle Java 7 Update 11 or later (or migrate to modern LTS versions like Java 8/11/17), and disable the Java browser plug-in across all enterprise endpoints.

[Affected Scope] Microsoft Internet Explorer versions 6, 7, and 8

[Impact] Remote attackers can execute arbitrary code with user privileges via a crafted malicious website

[Mitigation] Apply the official MS13-008 security update, transition to a modern browser, or apply EMET mitigations

[Affected Scope] Adobe Flash Player versions prior to 11.4.402.265

[Impact] Remote attackers can trigger an integer overflow via malformed arguments, leading to arbitrary code execution on the target system

[Mitigation] Completely uninstall legacy Flash Player or upgrade to a patched version, and disable Flash execution across all web browsers

[Affected Scope] Microsoft Internet Explorer versions 6, 7, 8, and 9

[Impact] Remote attackers can execute arbitrary code with the privileges of the current user by enticing a user to visit a specially crafted website

[Mitigation] Apply the official cumulative security update (MS12-063), transition to a modern supported browser, or apply the official Fix it solution

[Affected Scope] Microsoft Office 2003 SP3, 2007 SP2/SP3, 2010 Gold/SP1, and systems utilizing Visual Basic for Applications (VBA)

[Impact] Local attackers can execute arbitrary code and escalate privileges by tricking a user into opening a document in a directory containing a malicious DLL

[Mitigation] Apply the official Microsoft security update (MS12-046) and restrict insecure DLL loading via registry modifications