Multiple vulnerabilities in Adobe Shockwave Player

1) Input validation error

EUVDB-ID: #VU44947

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2108

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors, related to a "design flaw."

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://osvdb.org/73012
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.securityfocus.com/bid/48311
http://www.us-cert.gov/cas/techalerts/TA11-166A.html
http://exchange.xforce.ibmcloud.com/vulnerabilities/68033

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU44948

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2109

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple integer overflows in Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allow attackers to execute arbitrary code via unspecified vectors.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://osvdb.org/73033
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU44949

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2111

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

IML32.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2115 and CVE-2011-2116.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Buffer overflow

EUVDB-ID: #VU44950

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2112

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple buffer overflows in IML32.dll in Adobe Shockwave Player before 11.6.0.626 allow attackers to execute arbitrary code via unspecified vectors.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Buffer overflow

EUVDB-ID: #VU44951

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2113

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Multiple buffer overflows in the Shockwave3DAsset component in Adobe Shockwave Player before 11.6.0.626 allow attackers to execute arbitrary code via unspecified vectors.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU44952

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2114

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2117, CVE-2011-2124, CVE-2011-2127, and CVE-2011-2128.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Heap-based buffer overflow

EUVDB-ID: #VU44953

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2011-2115

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in IML32.dll in Adobe Shockwave Player before 11.6.0.626. A remote attacker can use a crafted tSAC chunk to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Shockwave Player: 1.0 - 11.5.9.615

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=919
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Buffer overflow

EUVDB-ID: #VU44954

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2116

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

IML32.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2111 and CVE-2011-2115.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU44955

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2117

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2114, CVE-2011-2124, CVE-2011-2127, and CVE-2011-2128.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Input validation error

EUVDB-ID: #VU44956

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2118

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The FLV ASSET Xtra component in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors, related to an "input validation vulnerability."

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Buffer overflow

EUVDB-ID: #VU44957

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2119

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-0335, and CVE-2011-2122.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Input validation error

EUVDB-ID: #VU44958

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2120

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Integer overflow in the CursorAsset x32 component in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Input validation error

EUVDB-ID: #VU44959

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2121

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Integer overflow in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://osvdb.org/73034
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Buffer overflow

EUVDB-ID: #VU44960

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2122

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors related to rcsL substructures, a different vulnerability than CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-0335, and CVE-2011-2119.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://osvdb.org/73029
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.securityfocus.com/archive/1/518439/100/0/threaded
http://www.securityfocus.com/bid/48297
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Heap-based buffer overflow

EUVDB-ID: #VU44961

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2011-2123

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Integer overflow in the Shockwave 3D Asset x32 component in Adobe Shockwave Player before 11.6.0.626. A remote attacker can use a crafted subrecord in a DEMX chunk to trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Shockwave Player: 1.0 - 11.5.9.615

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=922
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Buffer overflow

EUVDB-ID: #VU44962

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2124

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2114, CVE-2011-2117, CVE-2011-2127, and CVE-2011-2128.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://osvdb.org/73019
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.securityfocus.com/bid/48294
http://www.us-cert.gov/cas/techalerts/TA11-166A.html
http://exchange.xforce.ibmcloud.com/vulnerabilities/68048

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Buffer overflow

EUVDB-ID: #VU44963

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2125

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer overflow in Dirapix.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://osvdb.org/73015
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.securityfocus.com/bid/48308
http://www.us-cert.gov/cas/techalerts/TA11-166A.html
http://exchange.xforce.ibmcloud.com/vulnerabilities/68049

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Buffer overflow

EUVDB-ID: #VU44964

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2126

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Buffer overflow in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://osvdb.org/73011
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.securityfocus.com/bid/48309
http://www.us-cert.gov/cas/techalerts/TA11-166A.html
http://exchange.xforce.ibmcloud.com/vulnerabilities/68050

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Buffer overflow

EUVDB-ID: #VU44965

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2127

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2114, CVE-2011-2117, CVE-2011-2124, and CVE-2011-2128.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://osvdb.org/73032
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.securityfocus.com/bid/48289
http://www.us-cert.gov/cas/techalerts/TA11-166A.html
http://exchange.xforce.ibmcloud.com/vulnerabilities/68051

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Buffer overflow

EUVDB-ID: #VU44966

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2128

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2114, CVE-2011-2117, CVE-2011-2124, and CVE-2011-2127.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://osvdb.org/73027
http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.securityfocus.com/bid/48290
http://www.us-cert.gov/cas/techalerts/TA11-166A.html
http://exchange.xforce.ibmcloud.com/vulnerabilities/68052

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Buffer overflow

EUVDB-ID: #VU44967

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-0317

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-0335, CVE-2011-2119, and CVE-2011-2122.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Buffer overflow

EUVDB-ID: #VU44968

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-0318

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0317, CVE-2011-0319, CVE-2011-0320, CVE-2011-0335, CVE-2011-2119, and CVE-2011-2122.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Buffer overflow

EUVDB-ID: #VU44969

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-0319

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0317, CVE-2011-0318, CVE-2011-0320, CVE-2011-0335, CVE-2011-2119, and CVE-2011-2122.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Buffer overflow

EUVDB-ID: #VU44970

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-0320

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0335, CVE-2011-2119, and CVE-2011-2122.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Buffer overflow

EUVDB-ID: #VU44971

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-0335

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Dirapi.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0317, CVE-2011-0318, CVE-2011-0319, CVE-2011-0320, CVE-2011-2119, and CVE-2011-2122.

Install update from vendor's website.

Shockwave Player: 1.0 - 11.5.9.615

http://www.adobe.com/support/security/bulletins/apsb11-17.html
http://www.us-cert.gov/cas/techalerts/TA11-166A.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.