TPTI-11-02: Adobe Shockwave TextXtra Invalid Seek Remote Code Execution Vulnerability

TPTI-11-02: Adobe Shockwave TextXtra Invalid Seek Remote Code Execution Vulnerability http://dvlabs.tippingpoint.com/advisory/TPTI-11-02 February 8, 2011 -- CVE ID: CVE-2011-0555 -- CVSS: 9, AV:N/AC:L/Au:N/C:P/I:P/A:C -- Affected Vendors: Adobe -- Affected Products: Adobe Shockwave Player --...

CVE-2011-0555

The TextXtra.x32 module in Adobe Shockwave Player before 11.5.9.620 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a Director file with a crafted DEMX RIFF chunk that triggers incorrect buffer allocation, a different vulnerability than...

CVE-2011-0556

The Font Xtra.x32 module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted PFR1 chunk that leads to an unexpected sign extension and an invalid pointer dereference, a different vulnerability than...

Heap overflow

The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with an IFWV chunk with a size field of 0, which is used in the calculation of a file offset and causes invalid data to ...

Memory corruption

Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with a crafted CSWV RIFF chunk that causes an incorrect calculation of an offset for a substructure, which causes an out-of-bounds "seek" of heap...

Memory corruption

The Font Xtra.x32 module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted PFR1 chunk that leads to an unexpected sign extension and an invalid pointer dereference, a different vulnerability than...

Buffer overflow

The Font Xtra.x32 module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a PFR1 chunk containing an invalid size value that leads to an unexpected sign extension and a buffer overflow, a different...

CVE-2011-0555

The TextXtra.x32 module in Adobe Shockwave Player before 11.5.9.620 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a Director file with a crafted DEMX RIFF chunk that triggers incorrect buffer allocation, a different vulnerability than...

CVE-2010-4188

The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with an IFWV chunk with a size field of 0, which is used in the calculation of a file offset and causes invalid data to ...

CVE-2010-4190

Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with a crafted CSWV RIFF chunk that causes an incorrect calculation of an offset for a substructure, which causes an out-of-bounds "seek" of heap...

CVE-2011-0569

The CVE-2011-0569 entry concerns Adobe Shockwave Player’s Font Xtra.x32 module. The vulnerability arises in the PFR1 chunk parsing when a 16-bit size value is sign-extended and used in a copy loop, leading to a buffer overflow that can enable arbitrary code execution or memory corruption. Affecte...

CVE-2010-4190: Improper Restriction of Operations within the Bounds of a Memory Buffer

Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with a crafted CSWV RIFF chunk that causes an incorrect calculation of an offset for a substructure, which causes an out-of-bounds "seek" of heap...

CVE-2011-0555: Improper Restriction of Operations within the Bounds of a Memory Buffer

The TextXtra.x32 module in Adobe Shockwave Player before 11.5.9.620 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a Director file with a crafted DEMX RIFF chunk that triggers incorrect buffer allocation, a different vulnerability than...

CVE-2011-0556: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Font Xtra.x32 module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted PFR1 chunk that leads to an unexpected sign extension and an invalid pointer dereference, a different vulnerability than...

CVE-2010-4188: Improper Restriction of Operations within the Bounds of a Memory Buffer

The dirapi.dll module in Adobe Shockwave Player before 11.5.9.620 allows attackers to execute arbitrary code or cause a denial of service memory corruption via a Director movie with an IFWV chunk with a size field of 0, which is used in the calculation of a file offset and causes invalid data to ...

Adobe Shockwave CSWV Chunk Substructure Offset Value Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CA Internet Security Suite 2010 - KmxSbx.sys Kernel Pool Overflow

CA Internet Security Suite 2010 - KmxSbx.sys Kernel Pool Overflow / Exploit Title: CA Internet Security Suite 2010 KmxSbx.sys Kernel Pool Overflow 0-day Exploit Date: 2010-11-28 Author: Nikita Tarakanov CISS Research Team Software Link:...

Adobe Shockwave Director PAMI Chunk Parsing Memory Corruption (CVE-2010-2872)

Adobe Shockwave is a multimedia player that allows Adobe Director applications to be published on the Internet and viewed in a web browser by anyone who has the Shockwave plug-in installed. A remote code execution vulnerability has been identified in Adobe Shockwave Player. The vulnerability is d...

Adobe Shockwave Player Lnam Chunk Processing Buffer Overflow

Added: 11/08/2010 CVE: CVE-2010-3655 BID: 44516 Background Adobe Shockwave is a multimedia player used to add animation and interactivity to web pages. It allows Adobe Director applications to be published on the Internet and viewed in a web browser on any computer which has the Shockwave plug-in...

Adobe Shockwave Player Lnam Chunk Processing Buffer Overflow

Added: 11/08/2010 CVE: CVE-2010-3655 BID: 44516 Background Adobe Shockwave is a multimedia player used to add animation and interactivity to web pages. It allows Adobe Director applications to be published on the Internet and viewed in a web browser on any computer which has the Shockwave plug-in...