NetSight
IP …
high7.8Known exploitedPublic exploit code

CVE-2010-1297

Adobe Flash Player Memory Corruption Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-06-08. Federal due date: 2022-06-22.

The impacted product is end-of-life and should be disconnected if still in use.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Affected products

VendorProductAffected versions
AdobeAir
before 2.0.2.12610
AdobeFlash Player
before 9.0.277.0
from 10.0 before 10.1.53.64
AdobeAcrobat
from 8.0 before 8.2.3
from 9.0 before 9.3.3
OpensuseOpensuse
from 11.0 through 11.2
SuseLinux Enterprise
Versions 10.0, 11.0

Weakness classification

CWE-787

References