| Vulnerability Name: | CVE-2010-0129 (CCN-58443) | ||||||||||||
| Assigned: | 2010-05-11 | ||||||||||||
| Published: | 2010-05-11 | ||||||||||||
| Updated: | 2022-06-07 | ||||||||||||
| Summary: | Multiple integer overflows in Adobe Shockwave Player before 11.5.7.609 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .dir (aka Director) file that triggers an array index error. | ||||||||||||
| CVSS v3 Severity: | 8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
| ||||||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||||||
| Vulnerability Type: | CWE-190 | ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: FULLDISC Type: Broken Link 20100511 [CAL-20100204-2]Adobe Shockwave Player Director File Parsing integer overflow vulnerability Source: MITRE Type: CNA CVE-2010-0129 Source: MISC Type: Broken Link, Third Party Advisory http://hi.baidu.com/fs_fx/blog/item/fa74a61705b5e24621a4e951.html Source: IDEFENSE Type: Broken Link 20100511 Abobe Shockwave Player Heap Memory Indexing Vulnerability Source: CCN Type: SA38451 Squid DNS Packet Processing Denial of Service Vulnerability Source: CCN Type: SA38751 Adobe Shockwave Player Multiple Vulnerabilities Source: SECUNIA Type: Broken Link, Vendor Advisory 38751 Source: MISC Type: Broken Link, Vendor Advisory http://secunia.com/secunia_research/2010-20/ Source: CCN Type: Adobe Product Security Bulletin APSB10-12 Security update available for Shockwave Player Source: CONFIRM Type: Patch, Vendor Advisory http://www.adobe.com/support/security/bulletins/apsb10-12.html Source: CCN Type: OSVDB ID: 64642 Adobe Shockwave Player Crafted DIR File Index Array Multiple Overflows Source: BUGTRAQ Type: Broken Link, VDB Entry 20100512 [CAL-20100204-2]Adobe Shockwave Player Director File Parsing integer overflow vulnerability Source: BUGTRAQ Type: Broken Link, VDB Entry 20100512 Secunia Research: Adobe Shockwave Player Array Indexing Vulnerability Source: BID Type: Broken Link, VDB Entry 40082 Source: CCN Type: BID-40082 Adobe Shockwave Player Director File Multiple Remote Code Execution Vulnerabilities Source: VUPEN Type: Broken Link, Vendor Advisory ADV-2010-1128 Source: XF Type: UNKNOWN shockwave-director-code-exec(58443) Source: OVAL Type: Third Party Advisory oval:org.mitre.oval:def:7134 | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||