Buffer overflow in Adobe Shockwave_player
CVE-2010-3653
The Director module (dirapi.dll) in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie with a crafted rcsL chunk containing a fie…
Vulnerability class: Buffer Overflow
EPSS: 0.778 (99.0th percentile) — read the EPSS interpretation.
Affected products
- Adobe Shockwave_player — versions 11.5.6.606, 8.5.324, 3.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@adobe.com (x_refsource_CONFIRM)
- adobe-shockwave-rcsl-code-exec(62688) (vdb-entry, x_refsource_XF)
- psirt@adobe.com (x_refsource_MISC)
- 15296 (Exploit, exploit, x_refsource_EXPLOIT-DB)
- VU#402231 (x_refsource_CERT-VN, US Government Resource, third-party-advisory)
- oval:org.mitre.oval:def:11285 (x_refsource_OVAL, signature, vdb-entry)
- 44291 (Exploit, vdb-entry, x_refsource_BID)
- 1024635 (vdb-entry, x_refsource_SECTRACK)
- ADV-2010-2752 (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
Frequently asked questions
- What is CVE-2010-3653?
- CVE-2010-3653 is a vulnerability in Adobe Shockwave_player, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2010-10-26.
- Is CVE-2010-3653 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.