Vulnerability Name: | CVE-2010-3127 (CCN-64305) | ||||||||
Assigned: | 2010-08-26 | ||||||||
Published: | 2010-08-26 | ||||||||
Updated: | 2017-09-19 | ||||||||
Summary: | Untrusted search path vulnerability in Adobe PhotoShop CS2 through CS5 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll or Wintab32.dll that is located in the same folder as a PSD or other file that is processed by PhotoShop. Note: some of these details are obtained from third party information. Per: http://cwe.mitre.org/data/definitions/426.html CWE-426 - 'Untrusted Search Path Vulnerability' | ||||||||
CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
Vulnerability Type: | CWE-Other | ||||||||
Vulnerability Consequences: | Gain Access | ||||||||
References: | Source: MISC Type: UNKNOWN http://blog.zoller.lu/2010/08/cve-2010-xn-loadlibrarygetprocaddress.html Source: MITRE Type: CNA CVE-2010-3127 Source: CCN Type: SA41060 Adobe Photoshop Insecure Library Loading Vulnerability Source: SECUNIA Type: Vendor Advisory 41060 Source: CCN Type: Adobe Web Site Adobe Photoshop 12.0.3 update for Adobe Photoshop CS5 Source: CCN Type: Adobe Product Security Bulletin APSB10-30 Security update available for Adobe Photoshop CS5 Source: EXPLOIT-DB Type: UNKNOWN 14741 Source: CCN Type: OSVDB ID: 67545 Adobe Photoshop Path Subversion Arbitrary DLL Injection Code Execution Source: CCN Type: BID-45492 Adobe Photoshop DLL Loading Arbitrary Code Execution Vulnerability Source: VUPEN Type: Vendor Advisory ADV-2010-2170 Source: XF Type: UNKNOWN adobe-photoshop-dll-code-execution(64305) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:6778 | ||||||||
Vulnerable Configuration: | Configuration 1: Configuration CCN 1: Denotes that component is vulnerable | ||||||||
Oval Definitions | |||||||||
| |||||||||
BACK |