Vulnerability CVE-2010-3654
Published: 2010-10-29   Modified: 2012-02-13

Description:
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.

See advisories in our WLB2 database:
Topic
Author
Date
High
Adobe Flash Player < 10.1.53 .64 Action Script Type Confusion Exploit (DEP+ASLR bypass)
Abysssec
20.04.2011

Type:

CWE-119

 (Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Macromedia -> Flash player 
Adobe -> Acrobat 
Adobe -> Acrobat reader 
Adobe -> Flash player 

 References:
http://www.kb.cert.org/vuls/id/298081
http://www.vupen.com/english/advisories/2011/0344
http://www.vupen.com/english/advisories/2011/0192
http://www.vupen.com/english/advisories/2011/0191
http://www.vupen.com/english/advisories/2011/0173
http://www.vupen.com/english/advisories/2010/3111
http://www.vupen.com/english/advisories/2010/2918
http://www.vupen.com/english/advisories/2010/2906
http://www.vupen.com/english/advisories/2010/2903
http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt
http://www.securitytracker.com/id?1024660
http://www.securitytracker.com/id?1024659
http://www.securityfocus.com/bid/44504
http://www.redhat.com/support/errata/RHSA-2010-0934.html
http://www.redhat.com/support/errata/RHSA-2010-0867.html
http://www.redhat.com/support/errata/RHSA-2010-0834.html
http://www.redhat.com/support/errata/RHSA-2010-0829.html
http://www.adobe.com/support/security/bulletins/apsb10-28.html
http://www.adobe.com/support/security/bulletins/apsb10-26.html
http://www.adobe.com/support/security/advisories/apsa10-05.html
http://support.apple.com/kb/HT4435
http://securityreason.com/securityalert/8210
http://security.gentoo.org/glsa/glsa-201101-09.xml
http://security.gentoo.org/glsa/glsa-201101-08.xml
http://secunia.com/advisories/43026
http://secunia.com/advisories/43025
http://secunia.com/advisories/42926
http://secunia.com/advisories/42401
http://secunia.com/advisories/42183
http://secunia.com/advisories/42030
http://secunia.com/advisories/41917
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:13294
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html
http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1
Copyright 2024, cxsecurity.com

 

Back to Top