CVE-2010-2876

Adobe Shockwave Player before 11.5.8.612 does not properly validate values associated with buffer-size calculation for a 0xFFFFFFF8 record in a 1 .dir or 2 .dcr Director movie, which allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafte...

CVE-2010-2873

Adobe Shockwave Player before 11.5.8.612 does not properly validate offset values in the rcsL RIFF chunks of 1 .DIR and 2 .DCR Director movies, which allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted movie...

CVE-2010-2878

DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly validate a value associated with a buffer seek for a Director movie, which allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted movie...

CVE-2010-2867

DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly handle a certain return value associated with the rcsL chunk in a Director movie, which allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted movie, related to a...

CVE-2009-3743

Off-by-one error in the InsMINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a malformed TrueType font in a document that trigger an integer overflow and a...

CVE-2010-2870

DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly validate a certain chunk size in the mmap chunk in a Director movie, which allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted movie...

DEBIAN-CVE-2009-3743

Off-by-one error in the InsMINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a malformed TrueType font in a document that trigger an integer overflow and a...

CVE-2009-3743

Off-by-one error in the InsMINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a malformed TrueType font in a document that trigger an integer overflow and a...

Memory corruption

Adobe Shockwave Player before 11.5.8.612 does not properly validate values associated with buffer-size calculation for a 0xFFFFFFF8 record in a 1 .dir or 2 .dcr Director movie, which allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafte...

Null pointer dereference

DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly handle a certain return value associated with the rcsL chunk in a Director movie, which allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted movie, related to a...

Integer overflow

Off-by-one error in the InsMINDEX function in the TrueType bytecode interpreter in Ghostscript before 8.71 allows remote attackers to execute arbitrary code or cause a denial of service heap memory corruption via a malformed TrueType font in a document that trigger an integer overflow and a...

Integer overflow

Multiple integer overflows in the allocator in the TextXtra.x32 module in Adobe Shockwave Player before 11.5.8.612 allow remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted 1 element count or 2 element size value in a file...

Integer overflow

Integer overflow in the 3D object functionality in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted size value in a 0xFFFFFF45 RIFF record in a Director movie...

Memory corruption

DIRAPIX.dll in Adobe Shockwave Player before 11.5.8.612 does not properly validate a certain chunk size in the mmap chunk in a Director movie, which allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted movie...

Memory corruption

Adobe Shockwave Player before 11.5.8.612 does not properly validate offset values in the rcsL RIFF chunks of 1 .DIR and 2 .DCR Director movies, which allows remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted movie...

CVE-2010-2879

Multiple integer overflows in the allocator in the TextXtra.x32 module in Adobe Shockwave Player before 11.5.8.612 allow remote attackers to cause a denial of service heap memory corruption or execute arbitrary code via a crafted 1 element count or 2 element size value in a file...

CVE-2010-2873

Adobe Shockwave Player is affected by CVE-2010-2873 and related CVEs due to improper validation of offset values in rcsL RIFF chunks within Director files (.DIR/.DCR). This leads to heap memory corruption and can allow remote code execution or a denial of service when a crafted movie is processed...

CVE-2010-2879

Adobe Shockwave Player contains a CVE-2010-2879 vulnerability: an integer overflow in the TextXtra.x32 allocator can cause heap memory corruption, enabling remote code execution or a denial of service. Affected product/version: Shockwave Player before 11.5.8.612. Root cause: faulty heap allocatio...

CVE-2010-2867

CVE-2010-2867 affects Adobe Shockwave Player (before 11.5.8.612). The vulnerability lies in the Director RIFF-based parsing of the rcsL chunk, where DIRAPIX sign-extends a WORD value and uses it as a heap buffer offset, enabling remote attackers to cause a denial of service (heap memory corruptio...

CVE-2010-2878

Adobe Shockwave Player contains a DIRAPIX.dll flaw (CVE-2010-2878) where improper handling of a Director movie buffer seek leads to heap memory corruption, enabling remote code execution or crash. Affected product: Shockwave Player before 11.5.8.612. Attack requires a crafted movie; vendor adviso...