Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.
結論預警: CVE-2011-0611 綜合評估為嚴重在野威脅（100/100）：CVSS 技術影響為高級，利用機率偏高（EPSS 99.41%，百分位 100%） 核心證據: CISA 已知被利用漏洞目錄（KEV）已於 2022-03-03 確認在野利用，影響 Adobe / Flash Player，弱點類型（CWE-843），攻擊者可能未經認證遠端取得高權限管理存取。 近一日 EPSS 上升 +5.88%，被利用關注度持續升高。 強制指令: CISA 處置期限已過，應以應急修補優先立即處理。
風險隨態勢動態變化；本站持續評估並同步更新本頁展示內容。
: Adobe Flash Player Remote Code Execution Vulnerability · CISA KEV 詳情
: 2022-03-03
: 2022-03-24
: The impacted product is end-of-life and should be disconnected if still in use.
| EDB-ID | 來源 | 類型 | 公開時間 | 連結 |
|---|---|---|---|---|
| 17473 | exploit_db | edb | 2011-07-03 | Exploit-DB ↗ |
| 17175 | exploit_db | edb | 2011-04-16 | Exploit-DB ↗ |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ | |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ | |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS 日更估計相對被利用可能性；百分位表示該 CVE 在已評分漏洞中的相對排名（越高表示相對更嚴重）。
| # | 日期 | 舊 EPSS 分數 | 新 EPSS 分數 | 變化（新 − 舊） |
|---|---|---|---|---|
| 1 | 2026-06-15 | 93.53% | 99.41% | +5.88% |
| 2 | 2026-05-07 | 93.65% | 93.53% | -0.13% |
| 3 | 2026-04-02 | — | 93.65% | — |
完整 EPSS 歷史 （共 34 筆）
該 CVE 的 CVSS 指標。
| 底座分 | 版本 | 嚴重度 | 向量 | 可利用性 | 影響 | 分數來源 |
|---|---|---|---|---|---|---|
| 8.8 | 3.1 | HIGH |
|
2.8 | 5.9 | [email protected] |
| 8.8 | 3.1 | HIGH |
|
2.8 | 5.9 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| 9.3 | 2.0 | HIGH |
|
8.6 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
gentoo
|
normal | CVE-2011-0611: 1 GLSA(s) (201110-11), 1 atom(s) (www-plugins/adobe-flash); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2011-0611 |
redhat
|
critical | — | https://access.redhat.com/security/cve/CVE-2011-0611 |
ubuntu
|
medium | CVE-2011-0611 medium priority: Ubuntu including 4 source packages (acroread, adobe-flashplugin, adobeair, flashplugin-nonfree), 27 status rows across 7 suites (dapper, hardy, karmic, lucid, maverick, natty, upstream): released 15, not-affected 6, ignored 3, DNE 2, needs-triage 1. | https://ubuntu.com/security/CVE-2011-0611 |
| 廠商 | 產品 | 版本 | 原始 CPE |
|---|---|---|---|
| adobe | flash_player | < 10.2.154.27 | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* |
| adobe | flash_player | <= 10.2.156.12 | cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* |
| adobe | acrobat_reader | >= 9.0, < 9.4.4 | cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* |
| adobe | acrobat_reader | >= 10.0, <= 10.0.1 | cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* |
| adobe | adobe_air | < 2.6.19140 | cpe:2.3:a:adobe:adobe_air:*:*:*:*:*:*:*:* |
| adobe | acrobat_reader | >= 10.0, < 10.0.3 | cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:* |
| adobe | acrobat | >= 9.0, < 9.4 | cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* |
| adobe | acrobat | >= 10.0, < 10.0.3 | cpe:2.3:a:adobe:acrobat:*:*:*:*:*:*:*:* |
| chrome | < 10.0.648.205 | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | |
| opensuse | opensuse | 11.2 | cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:* |
| opensuse | opensuse | 11.3 | cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:* |
| opensuse | opensuse | 11.4 | cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* |
| suse | linux_enterprise_desktop | 10 | cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:-:*:*:* |
| suse | linux_enterprise_desktop | 11 | cpe:2.3:o:suse:linux_enterprise_desktop:11:sp1:*:*:*:*:*:* |