PT-2012-6257 · Adobe · Shockwave Player

Will Dormann · Published 2012-12-20 · Updated 2017-11-17 · CVE-2012-6271

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Shockwave Player versions prior to 11.6.8.638

Description The issue allows remote attackers to trigger the installation of arbitrary signed Xtras via a Shockwave movie that contains an Xtra URL. This can be demonstrated by a URL for an outdated Xtra.

Recommendations For Adobe Shockwave Player versions prior to 11.6.8.638, update to version 11.6.8.638 or later to resolve the issue.

Fix

Related Identifiers

CVE-2012-6271

Affected Products

Shockwave Player

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2012-6271 · Security Note
• http://kb.cert.org/vuls/id/519137 · Note
• http://kb.cert.org/vuls/id/323161 · Note