CVE-2011-2119
Adobe Shockwave rcsL String Parsing Remote Code Execution Vulnerability
Severity Score
9.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-0335, and CVE-2011-2122.
Dirapi.dll en Adobe Shockwave Player anterior a v11.6.0.626 permite a atacantes ejecutar código de su elección o provocar una denegación de servicio (corrupción de memoria) a través de vectores no especificados. Vulnerabilidad distinta de CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-0335 y CVE-2011-2122.
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of the Adobe Shockwave Player. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the code responsible for parsing the rcsL RIFF chunk within Director files. The logic within the DIRAPI.dll module fails to account for a specific condition and can be made to misallocate a buffer on the heap. By crafting specific values within rcsL substructures an attacker can corrupt memory leading to arbitrary code execution under the context of the user running the browser.
*Credits:
Luigi Auriemma
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2011-05-13 CVE Reserved
- 2011-06-14 CVE Published
- 2023-10-23 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| http://www.us-cert.gov/cas/techalerts/TA11-166A.html | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.adobe.com/support/security/bulletins/apsb11-17.html | 2011-10-05 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | <= 11.5.9.620 Search vendor "Adobe" for product "Shockwave Player" and version " <= 11.5.9.620" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 1.0 Search vendor "Adobe" for product "Shockwave Player" and version "1.0" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 2.0 Search vendor "Adobe" for product "Shockwave Player" and version "2.0" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 3.0 Search vendor "Adobe" for product "Shockwave Player" and version "3.0" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 4.0 Search vendor "Adobe" for product "Shockwave Player" and version "4.0" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 5.0 Search vendor "Adobe" for product "Shockwave Player" and version "5.0" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 6.0 Search vendor "Adobe" for product "Shockwave Player" and version "6.0" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.0 Search vendor "Adobe" for product "Shockwave Player" and version "8.0" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.0.196 Search vendor "Adobe" for product "Shockwave Player" and version "8.0.196" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.0.196a Search vendor "Adobe" for product "Shockwave Player" and version "8.0.196a" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.0.204 Search vendor "Adobe" for product "Shockwave Player" and version "8.0.204" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.0.205 Search vendor "Adobe" for product "Shockwave Player" and version "8.0.205" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.5.1 Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.5.1.100 Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.100" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.5.1.103 Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.103" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.5.1.105 Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.105" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.5.1.106 Search vendor "Adobe" for product "Shockwave Player" and version "8.5.1.106" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.5.321 Search vendor "Adobe" for product "Shockwave Player" and version "8.5.321" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.5.323 Search vendor "Adobe" for product "Shockwave Player" and version "8.5.323" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.5.324 Search vendor "Adobe" for product "Shockwave Player" and version "8.5.324" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 8.5.325 Search vendor "Adobe" for product "Shockwave Player" and version "8.5.325" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 9 Search vendor "Adobe" for product "Shockwave Player" and version "9" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 9.0.383 Search vendor "Adobe" for product "Shockwave Player" and version "9.0.383" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 9.0.432 Search vendor "Adobe" for product "Shockwave Player" and version "9.0.432" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 10.0.0.210 Search vendor "Adobe" for product "Shockwave Player" and version "10.0.0.210" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 10.0.1.004 Search vendor "Adobe" for product "Shockwave Player" and version "10.0.1.004" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 10.1.0.11 Search vendor "Adobe" for product "Shockwave Player" and version "10.1.0.11" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 10.1.0.011 Search vendor "Adobe" for product "Shockwave Player" and version "10.1.0.011" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 10.1.1.016 Search vendor "Adobe" for product "Shockwave Player" and version "10.1.1.016" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 10.1.4.020 Search vendor "Adobe" for product "Shockwave Player" and version "10.1.4.020" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 10.2.0.021 Search vendor "Adobe" for product "Shockwave Player" and version "10.2.0.021" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 10.2.0.022 Search vendor "Adobe" for product "Shockwave Player" and version "10.2.0.022" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 10.2.0.023 Search vendor "Adobe" for product "Shockwave Player" and version "10.2.0.023" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.0.0.456 Search vendor "Adobe" for product "Shockwave Player" and version "11.0.0.456" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.0.3.471 Search vendor "Adobe" for product "Shockwave Player" and version "11.0.3.471" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.5.0.595 Search vendor "Adobe" for product "Shockwave Player" and version "11.5.0.595" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.5.0.596 Search vendor "Adobe" for product "Shockwave Player" and version "11.5.0.596" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.5.1.601 Search vendor "Adobe" for product "Shockwave Player" and version "11.5.1.601" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.5.2.602 Search vendor "Adobe" for product "Shockwave Player" and version "11.5.2.602" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.5.6.606 Search vendor "Adobe" for product "Shockwave Player" and version "11.5.6.606" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.5.7.609 Search vendor "Adobe" for product "Shockwave Player" and version "11.5.7.609" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.5.8.612 Search vendor "Adobe" for product "Shockwave Player" and version "11.5.8.612" | - |
Affected
| ||||||
| Adobe Search vendor "Adobe" | Shockwave Player Search vendor "Adobe" for product "Shockwave Player" | 11.5.9.615 Search vendor "Adobe" for product "Shockwave Player" and version "11.5.9.615" | - |
Affected
| ||||||