CVE Vulnerability Advisory Database

[Affected Scope] Systems running Microsoft XML Core Services (MSXML) versions 3.0, 4.0, 5.0, and 6.0, primarily accessed via Internet Explorer

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) by enticing a user to visit a specially crafted malicious website

[Mitigation] Apply the official Microsoft security update (MS12-043) immediately, or implement ActiveX Kill Bit workarounds to block the execution of vulnerable MSXML components

[Affected Scope] Windows XP, Vista, 7, 8 Consumer Preview, and Windows Server 2003, 2008, 2008 R2

[Impact] Attackers can bypass Authenticode signature verification to execute arbitrary code via modified PE files containing malicious payloads that do not invalidate the digital signature

[Mitigation] Apply the official Microsoft MS12-024 security patch immediately and enforce strict software restriction policies

[Affected Scope] Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, macOS, Linux, and Solaris; Android 2.x/3.x/4.x mobile versions

[Impact] Remote attackers can bypass the Same-Origin Policy (SOP) via malicious Flash content, executing arbitrary scripts in the context of any website visited by the user to steal sessions and sensitive data

[Mitigation] Since Adobe Flash Player has reached End-of-Life (EOL), it must be completely uninstalled from all systems, or disabled at the browser level in legacy environments

[Affected Scope] Legacy Adobe Flash Player versions 10.x and 11.x on Windows, macOS, Linux, Solaris, and Android

[Impact] Attackers can execute arbitrary code or trigger a Denial of Service (DoS) via memory corruption by leveraging specially crafted Flash content

[Mitigation] Immediately uninstall legacy Flash Player components or restrict execution via browser policies and system-level access controls

[Affected Scope] Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.4.6 on UNIX

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (memory corruption) via a specially crafted PDF document containing malicious U3D data

[Mitigation] Apply the official security patches immediately, or disable the vulnerable U3D parsing component (rt3d.dll) as a temporary workaround

[Affected Scope] Windows XP, Vista, 7, and Windows Server 2003, 2008 kernel-mode drivers (win32k.sys)

[Impact] Remote code execution (RCE) with kernel-level privileges via crafted TrueType font data in Word documents or web pages

[Mitigation] Apply official MS11-087 security patches or implement the T2EMBED.DLL registry/ACL workaround

[Affected Scope] Android OS 3.0 and 2.x versions prior to 2.3.4

[Impact] Local attackers can execute arbitrary code and escalate privileges to root by sending crafted netlink messages

[Mitigation] Upgrade the Android operating system to version 2.3.4 or later, or apply the official vendor security patches

[Affected Scope] Adobe Flash Player 10.2.154.13 and earlier (Windows, macOS, Linux, Solaris), Flash Player for Android 10.1.106.16 and earlier, Adobe AIR 2.5.1 and earlier, and Authplay component in Adobe Reader/Acrobat 9.x through 9.4.2 and 10.x through 10.0.1

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (application crash) by tricking users into opening crafted Flash content (.swf), often embedded in Excel spreadsheets or malicious web pages

[Mitigation] Immediately upgrade affected Adobe products to patched versions, or completely uninstall/disable Flash Player and the Authplay.dll component on legacy systems

[Affected Scope] Linux kernel versions before 2.6.36 with the Reliable Datagram Sockets (RDS) protocol module enabled

[Impact] Local unprivileged users can exploit this vulnerability via crafted sendmsg and recvmsg system calls to gain full root privileges

[Mitigation] Upgrade the Linux kernel to a patched version, or disable the RDS kernel module by blacklisting it if not required

[Affected Scope] Microsoft PowerPoint 2002 SP3 and PowerPoint 2003 SP3

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user by tricking them into opening a crafted PowerPoint 95 document

[Mitigation] Apply the official MS10-088 security update or configure File Block settings via registry to restrict legacy PowerPoint 95 formats

[Affected Scope] Microsoft Internet Explorer versions 6, 7, and 8

[Impact] Remote attackers can execute arbitrary code with the privileges of the active user via a specially crafted web page

[Mitigation] Apply official cumulative security updates (MS10-090 or later), transition to modern browsers, or implement temporary workarounds

[Affected Scope] Mozilla Firefox 3.5.x through 3.5.14, 3.6.x through 3.6.11, Thunderbird 3.0.x through 3.0.9, 3.1.x through 3.1.5, and SeaMonkey 2.0.x through 2.0.9 with JavaScript enabled

[Impact] Remote attackers can trigger memory corruption and execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted webpage

[Mitigation] Immediately upgrade to patched versions (Firefox 3.5.15/3.6.12, Thunderbird 3.0.10/3.1.6, SeaMonkey 2.0.10 or later) or disable JavaScript as a temporary workaround

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document containing a long field in a SING table of a TTF font

[Mitigation] Immediately upgrade Adobe Reader and Acrobat to patched versions (9.4 / 8.2.5 or later) and restrict opening untrusted PDF attachments

[Affected Scope] Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1/SP2, Server 2008 SP2/R2, and Windows 7

[Impact] Local or remote attackers can execute arbitrary code with system privileges simply by tricking a user into viewing a folder containing a crafted .LNK or .PIF file

[Mitigation] Apply the official Microsoft MS10-046 security patch immediately, or implement workarounds to disable shortcut icon rendering and block outbound SMB/WebDAV traffic

[Affected Scope] Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader/Acrobat 9.x before 9.3.3 and 8.x before 8.2.3 on Windows and Mac OS X

[Impact] Successful exploitation allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content

[Mitigation] Immediately upgrade all affected Adobe products to the latest patched versions, or disable/rename the vulnerable authplay.dll component

[Affected Scope] Oracle Java SE and Java for Business 6 Update 18 and earlier, 5.0 Update 23 and earlier, and 1.4.2_25 and earlier

[Impact] Remote attackers can completely bypass Java sandbox restrictions and execute arbitrary code with the privileges of the running process, compromising confidentiality, integrity, and availability

[Mitigation] Immediately upgrade to the latest patched Java SE versions, disable Java browser plugins, and decommission unsupported legacy JRE environments

[Affected Scope] Microsoft Internet Explorer 6, 6 SP1, and 7.

[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted webpage.

[Mitigation] Apply the official Microsoft security updates, or implement workarounds such as setting the ActiveX Kill-Bit for the affected CLSID.

[Affected Scope] Microsoft Internet Explorer 6, 6 SP1, 7, and 8 running on Windows 2000, XP, Server 2003, Vista, Server 2008, and Windows 7

[Impact] Remote attackers can execute arbitrary code with the privileges of the logged-in user by enticing them to visit a specially crafted malicious webpage

[Mitigation] Apply the official Microsoft security update (KB979352) immediately, or implement temporary mitigations such as enabling DEP and disabling Active Scripting

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.3, 8.x before 8.2, and 7.x before 7.1.4 on Windows and Mac OS X

[Impact] Remote attackers can execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document containing malformed U3D data

[Mitigation] Apply the official vendor security patches immediately, or disable 3D/U3D rendering features via registry policies

[Affected Scope] Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X

[Impact] Remote attackers can execute arbitrary code on the target system by tricking a user into opening a specially crafted PDF file

[Mitigation] Immediately upgrade to patched versions (9.3 / 8.2 or higher) and restrict execution of untrusted PDF files