// For flags

CVE-2011-2113

Adobe Shockwave Shockwave 3d Asset.x32 DEMX Chunk Substructure Count Remote Code Execution Vulnerability

Severity Score

9.3
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Multiple buffer overflows in the Shockwave3DAsset component in Adobe Shockwave Player before 11.6.0.626 allow attackers to execute arbitrary code via unspecified vectors.

Múltiples desbordamientos de búfer en el componente Shockwave3DAsset en Adobe Shockwave Player anterior a v11.6.0.626, permite a atacantes ejecutar código de su elección a través de vectores no especificados.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the DEMX chunk inside Adobe's RIFF-based Director file format. The code within the Shockwave 3d Asset.x32 module does not properly check a size value used as the size for a malloc. The given size will wrap, causing a small buffer to be allocated. This can lead to memory corruption which can be leveraged to execute arbitrary code under the context of the user running the browser.

*Credits: Aniway (Aniway.Anyway@gmail.com)
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2011-05-13 CVE Reserved
  • 2011-06-14 CVE Published
  • 2024-08-06 CVE Updated
  • 2024-09-29 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
<= 11.5.9.620
Search vendor "Adobe" for product "Shockwave Player" and version " <= 11.5.9.620"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
1.0
Search vendor "Adobe" for product "Shockwave Player" and version "1.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
2.0
Search vendor "Adobe" for product "Shockwave Player" and version "2.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
3.0
Search vendor "Adobe" for product "Shockwave Player" and version "3.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
4.0
Search vendor "Adobe" for product "Shockwave Player" and version "4.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
5.0
Search vendor "Adobe" for product "Shockwave Player" and version "5.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
6.0
Search vendor "Adobe" for product "Shockwave Player" and version "6.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0
Search vendor "Adobe" for product "Shockwave Player" and version "8.0"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0.196
Search vendor "Adobe" for product "Shockwave Player" and version "8.0.196"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0.196a
Search vendor "Adobe" for product "Shockwave Player" and version "8.0.196a"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0.204
Search vendor "Adobe" for product "Shockwave Player" and version "8.0.204"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.0.205
Search vendor "Adobe" for product "Shockwave Player" and version "8.0.205"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1.100
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.100"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1.103
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.103"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1.105
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.105"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.1.106
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.106"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.321
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.321"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.323
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.323"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.324
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.324"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
8.5.325
Search vendor "Adobe" for product "Shockwave Player" and version "8.5.325"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
9
Search vendor "Adobe" for product "Shockwave Player" and version "9"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
9.0.383
Search vendor "Adobe" for product "Shockwave Player" and version "9.0.383"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
9.0.432
Search vendor "Adobe" for product "Shockwave Player" and version "9.0.432"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.0.0.210
Search vendor "Adobe" for product "Shockwave Player" and version "10.0.0.210"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.0.1.004
Search vendor "Adobe" for product "Shockwave Player" and version "10.0.1.004"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.1.0.11
Search vendor "Adobe" for product "Shockwave Player" and version "10.1.0.11"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.1.0.011
Search vendor "Adobe" for product "Shockwave Player" and version "10.1.0.011"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.1.1.016
Search vendor "Adobe" for product "Shockwave Player" and version "10.1.1.016"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.1.4.020
Search vendor "Adobe" for product "Shockwave Player" and version "10.1.4.020"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.2.0.021
Search vendor "Adobe" for product "Shockwave Player" and version "10.2.0.021"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.2.0.022
Search vendor "Adobe" for product "Shockwave Player" and version "10.2.0.022"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
10.2.0.023
Search vendor "Adobe" for product "Shockwave Player" and version "10.2.0.023"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.0.0.456
Search vendor "Adobe" for product "Shockwave Player" and version "11.0.0.456"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.0.3.471
Search vendor "Adobe" for product "Shockwave Player" and version "11.0.3.471"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.0.595
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.0.595"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.0.596
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.0.596"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.1.601
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.1.601"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.2.602
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.2.602"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.6.606
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.6.606"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.7.609
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.7.609"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.8.612
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.8.612"
-
Affected
Adobe
Search vendor "Adobe"
Shockwave Player
Search vendor "Adobe" for product "Shockwave Player"
11.5.9.615
Search vendor "Adobe" for product "Shockwave Player" and version "11.5.9.615"
-
Affected