CVE-2010-0128

Severity Score

9.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Integer signedness error in dirapi.dll in Adobe Shockwave Player before 11.5.7.609 and Adobe Director before 11.5.7.609 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted .dir file that triggers an invalid read operation.

Error de presencia de signo entero en dirapi.dll en Adobe Shockwave Player en versiones anteriores a la 11.5.7.609 y Adobe Director en versiones anteriores a la 11.5.7.609 permite a atacantes remotos provocar una denegación de servicio (corrupción de memoria) o posiblemente ejecutar código de su elección mediante un fichero .dir (también conocido como Director) manipulado que dispara una operación de lectura inválida.

*Credits: N/A

CVSS Scores

NISTv2 9.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-01-04 CVE Reserved
2010-05-12 CVE Published
2024-06-30 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-787: Out-of-bounds Write

CAPEC

References (8)

URL	Tag	Source
http://www.coresecurity.com/content/adobe-director-invalid-read	Broken Link
http://www.securityfocus.com/archive/1/511240/100/0/threaded	Broken Link
http://www.securityfocus.com/archive/1/511261/100/0/threaded	Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7273	Signature

URL	Date	SRC

URL	Date	SRC
http://www.adobe.com/support/security/bulletins/apsb10-12.html	2022-04-22

URL	Date	SRC
http://secunia.com/advisories/38751	2022-04-22
http://secunia.com/secunia_research/2010-19	2022-04-22
http://www.vupen.com/english/advisories/2010/1128	2022-04-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Adobe Search vendor "Adobe"	Shockwave Player Search vendor "Adobe" for product "Shockwave Player"	<= 11.5.6.606 Search vendor "Adobe" for product "Shockwave Player" and version " <= 11.5.6.606"	-	Affected	in	Apple Search vendor "Apple"	Macos Search vendor "Apple" for product "Macos"	*	-	Safe
Adobe Search vendor "Adobe"	Shockwave Player Search vendor "Adobe" for product "Shockwave Player"	<= 11.5.6.606 Search vendor "Adobe" for product "Shockwave Player" and version " <= 11.5.6.606"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	*	-	Safe
Adobe Search vendor "Adobe"		Director Search vendor "Adobe" for product "Director"				< 11.5.7.609 Search vendor "Adobe" for product "Director" and version " < 11.5.7.609"		-		Affected