CVE-2012-0767

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.htmlBroken Link
http://rhn.redhat.com/errata/RHSA-2012-0144.htmlThird Party Advisory
http://secunia.com/advisories/48265Broken Link
http://secunia.com/advisories/48819Broken Link
http://security.gentoo.org/glsa/glsa-201204-07.xmlThird Party Advisory
http://www.adobe.com/support/security/bulletins/apsb12-03.htmlBroken Link, Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14806Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15933Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00014.htmlBroken Link
http://rhn.redhat.com/errata/RHSA-2012-0144.htmlThird Party Advisory
http://secunia.com/advisories/48265Broken Link
http://secunia.com/advisories/48819Broken Link
http://security.gentoo.org/glsa/glsa-201204-07.xmlThird Party Advisory
http://www.adobe.com/support/security/bulletins/apsb12-03.htmlBroken Link, Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14806Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15933Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-0767US Government Resource

Timeline

Published: Feb 16, 2012
Last modified: Jun 16, 2026
Added to CISA KEV: Jun 8, 2022
NVD status: Analyzed

Related CVEs from 2012

CVE-2012-076810.0The Matrix3D component in Adobe Flash Player before 10.3.183.16 and 11.x before 11.1.102.63 on Windows, Mac OS X, Linux, and Solaris; before CVE-2012-07695.0Adobe Flash Player before 10.3.183.16 and 11.x before 11.1.102.63 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.7 on Android 2.x CVE-2012-07705.0Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 computes hash values for form parameters without restricting the ability to trigger hash collisi CVE-2012-07718.8Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns CVE-2012-077210.0An unspecified ActiveX control in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228, and AIR before 3.2.0.2070, on Windows CVE-2012-07739.3The NetStream class in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac OS X, and Linux; Flash Player befo CVE-2012-077410.0Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code via a crafte CVE-2012-077510.0The JavaScript implementation in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code CVE-2012-077610.0The installer in Adobe Reader 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to bypass intended access restrictions and execute ar CVE-2012-07776.8The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arb CVE-2012-077810.0Buffer overflow in Adobe Flash Professional before CS6 allows attackers to execute arbitrary code via unspecified vectors.CVE-2012-07799.3Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x