CVE-2010-1292

CRITICAL 9.3CVE-2010-1292 · Published 13/05/2010 · updated 16/06/2026

In short

CVE-2010-1292 is a CRITICAL (CVSS 9.3) vulnerability affecting shockwave player (adobe).
Chance of exploitation in the next 30 days (EPSS): 6.4%, higher than 93.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
shockwave player adobe	`= 1.0= 10.1.0.11= 11.0.0.456= 11.5.0.595= 11.5.0.596= 11.5.1.601= 11.5.2.602= 2.0= 3.0= 4.0= 5.0= 6.0= 8.0= 8.5.1= 9≤ 11.5.6.606`	No fix yet

Description

The implementation of pami RIFF chunk parsing in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file.

References

secunia.com/advisories/38751 · Vendor Advisory
adobe.com/support/security/bulletins/apsb10-12.html · Patch
securityfocus.com/archive/1/511242/100/0/threaded · Third Party Advisory
vupen.com/english/advisories/2010/1128 · Patch
zerodayinitiative.com/advisories/ZDI-10-089 · Third Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7416 · Third Party Advisory

More vulnerabilities in shockwave player

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

shockwave player

adobe

= 1.0= 10.1.0.11= 11.0.0.456= 11.5.0.595= 11.5.0.596= 11.5.1.601= 11.5.2.602= 2.0= 3.0= 4.0= 5.0= 6.0= 8.0= 8.5.1= 9≤ 11.5.6.606

No fix yet

Description

More vulnerabilities in shockwave player

See all →