CVE-2010-1297

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 82,5%

Kerentanan Out-of-bounds Write pada adobe air, adobe flash player +3 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 8 Juni 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Rincian

Terbit di NVD

8 Juni 2010

Terakhir diubah

16 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

82,5% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Adobe Flash Player Memory Corruption Vulnerability

Masuk KEV

8 Juni 2022

Tenggat CISA

22 Juni 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

The impacted product is end-of-life and should be disconnected if still in use.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://secunia.com/advisories/40026 broken link · advisory vendor
• http://secunia.com/advisories/40034 broken link · advisory vendor
• http://www.adobe.com/support/security/advisories/apsa10-01.html advisory vendor
• http://www.vupen.com/english/advisories/2010/1348 broken link · advisory vendor
• http://www.vupen.com/english/advisories/2010/1349 broken link · advisory vendor
• http://www.kb.cert.org/vuls/id/486225 advisory pihak ketiga · pemerintah AS
• http://www.us-cert.gov/cas/techalerts/TA10-159A.html advisory pihak ketiga · pemerintah AS
• http://www.us-cert.gov/cas/techalerts/TA10-162A.html advisory pihak ketiga · pemerintah AS
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1297 pemerintah AS
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html mailing list · advisory pihak ketiga
• http://security.gentoo.org/glsa/glsa-201101-09.xml advisory pihak ketiga
• http://securitytracker.com/id?1024057 broken link · advisory pihak ketiga · vdb entry
• http://securitytracker.com/id?1024058 broken link · advisory pihak ketiga · vdb entry
• http://securitytracker.com/id?1024085 broken link · advisory pihak ketiga · vdb entry
• http://securitytracker.com/id?1024086 broken link · advisory pihak ketiga · vdb entry
• http://www.exploit-db.com/exploits/13787 advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/40586 broken link · advisory pihak ketiga · vdb entry
• http://www.securityfocus.com/bid/40759 broken link · advisory pihak ketiga · vdb entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59137 advisory pihak ketiga · vdb entry
• http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/ exploit
• http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspx broken link
• http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 broken link
• http://secunia.com/advisories/40144 broken link