Lucene search

[email protected]CVE-2010-1292

HistoryMay 13, 2010 - 5:30 p.m.

CVE-2010-1292

2010-05-1317:30:02

CWE-119

[email protected]

web.nvd.nist.gov

cve-2010-1292

adobe shockwave player

remote code execution

memory corruption

vulnerability

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

8.7 High

AI Score

Confidence

High

0.185 Low

EPSS

Percentile

96.3%

JSON

The implementation of pami RIFF chunk parsing in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file.

Affected configurations

NVD

Node

adobeshockwave_playerRange≤11.5.6.606

adobeshockwave_playerMatch1.0

adobeshockwave_playerMatch2.0

adobeshockwave_playerMatch3.0

adobeshockwave_playerMatch4.0

adobeshockwave_playerMatch5.0

adobeshockwave_playerMatch6.0

adobeshockwave_playerMatch8.0

adobeshockwave_playerMatch8.5.1

adobeshockwave_playerMatch9

adobeshockwave_playerMatch10.1.0.11

adobeshockwave_playerMatch11.0.0.456

adobeshockwave_playerMatch11.5.0.595

adobeshockwave_playerMatch11.5.0.596

adobeshockwave_playerMatch11.5.1.601

adobeshockwave_playerMatch11.5.2.602

AND

applemacos

microsoftwindows

Node

adobeshockwave_playerMatch-

AND

microsoftwindows_7Match-

microsoftwindows_server_2003Match-

microsoftwindows_server_2008Match-

microsoftwindows_vistaMatch-

CPENameOperatorVersion
adobe:shockwave_playeradobe shockwave playerle11.5.6.606
adobe:shockwave_playeradobe shockwave playereq1.0
adobe:shockwave_playeradobe shockwave playereq2.0
adobe:shockwave_playeradobe shockwave playereq3.0
adobe:shockwave_playeradobe shockwave playereq4.0
adobe:shockwave_playeradobe shockwave playereq5.0
adobe:shockwave_playeradobe shockwave playereq6.0
adobe:shockwave_playeradobe shockwave playereq8.0
adobe:shockwave_playeradobe shockwave playereq8.5.1
adobe:shockwave_playeradobe shockwave playereq9

CPE	Name	Operator	Version
adobe:shockwave_player	adobe shockwave player	le	11.5.6.606
adobe:shockwave_player	adobe shockwave player	eq	1.0
adobe:shockwave_player	adobe shockwave player	eq	2.0
adobe:shockwave_player	adobe shockwave player	eq	3.0
adobe:shockwave_player	adobe shockwave player	eq	4.0
adobe:shockwave_player	adobe shockwave player	eq	5.0
adobe:shockwave_player	adobe shockwave player	eq	6.0
adobe:shockwave_player	adobe shockwave player	eq	8.0
adobe:shockwave_player	adobe shockwave player	eq	8.5.1
adobe:shockwave_player	adobe shockwave player	eq	9