PT-2010-2988 · Adobe · Shockwave Player

Published 2010-05-11 · Updated 2022-04-05 · CVE-2010-1283

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Shockwave Player versions prior to 11.5.7.609

Description The issue arises from improper parsing of 3D objects in .dir files, allowing remote attackers to execute arbitrary code or cause a denial of service due to heap memory corruption. This can be achieved by modifying a field in a 0xFFFFFF49 record.

Recommendations For Adobe Shockwave Player versions prior to 11.5.7.609, update to version 11.5.7.609 or later to resolve the issue.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2010-1283

ZDI-10-088

Affected Products

Shockwave Player

References · 8

• https://zerodayinitiative.com/advisories/ZDI-10-088 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-1283 · Security Note
• http://adobe.com/support/security/bulletins/apsb10-12.html · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7262 · Note
• http://secunia.com/advisories/38751 · Note
• http://vupen.com/english/advisories/2010/1128 · Note
• http://securityfocus.com/archive/1/511253/100/0/threaded · Note
• http://zerodayinitiative.com/advisories/ZDI-10-088 · Note