Vulnerability in Adobe Shockwave Player

CVE-2009-3466

Adobe Shockwave Player before 11.5.2.602 allows remote attackers to execute arbitrary code via a crafted web page that triggers memory corruption, related to an "invalid string length vulnerability." NOTE: some of these details are obtained from third party information.

EPSS: 0.042 (90.0th percentile) — read the EPSS interpretation.

Affected products

Adobe Shockwave_player — versions 1.0, 2.0, 3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-399

References

psirt@adobe.com (vdb-entry, x_refsource_XF)
psirt@adobe.com (vdb-entry, x_refsource_BID)
psirt@adobe.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
psirt@adobe.com (signature, x_refsource_OVAL, vdb-entry)
psirt@adobe.com (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
psirt@adobe.com (vdb-entry, x_refsource_SECTRACK)