Buffer overflow in Adobe Shockwave Player

CVE-2010-2581

dirapi.dll in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director file containing a crafted pamm chunk with an invalid (1) size and (2) number of sub-chunks, a different vulnerability than CVE-2010-4084, CVE-2010-4085, CVE-2010-4086, and CVE-2010-4088.

Vulnerability class: Buffer Overflow

EPSS: 0.045 (90.4th percentile) — read the EPSS interpretation.

Affected products

Adobe Shockwave_player — versions 11.5.6.606, 8.5.324, 3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_SECTRACK)
PSIRT-CNA@flexerasoftware.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
PSIRT-CNA@flexerasoftware.com (mailing-list, x_refsource_BUGTRAQ)
PSIRT-CNA@flexerasoftware.com (signature, x_refsource_OVAL, vdb-entry)
PSIRT-CNA@flexerasoftware.com (x_refsource_MISC)