CVE-2010-2872

Adobe Shockwave Player before 11.5.8.612 does not properly validate an offset value in the pami RIFF chunk in a Director movie, which allows remote attackers…

published August 26, 2010

CVSS
—
EPSS
6%
Percentile
93.4
In the wild
Unconfirmed
What it is

⚠️ A crafty movie file can take down Adobe Shockwave Player! This sneaky vulnerability allows attackers to manipulate the pami RIFF chunk, leading to potential memory corruption. 🔥 Think of it like a movie projectionist who misses a crucial frame while threading a film—if the projector misreads that part, it can cause the entire show to crash! If exploited, attackers could induce a denial of service, freezing the application and causing chaotic interruptions. Worse still, they might be able to execute arbitrary code, potentially taking control of the machine!

Put simply

Think of it like a movie projectionist who misses a crucial frame while threading a film—if the projector misreads that part, it can cause the entire show to crash! The vulnerability arises from improper validation of an offset value in the pami RIFF chunk within Director movies, allowing attackers to craft malicious movie files that trigger memory corruption.

What to do

If exploited, attackers could induce a denial of service, freezing the application and causing chaotic interruptions. Worse still, they might be able to execute arbitrary code, potentially taking control of the machine! Update Adobe Shockwave Player to version 11.5.8.612 or later as this fix addresses the validation issue. Regularly auditing third-party plugins can also help keep your environment secure! You've got this! Following these steps will help keep your system safe and sound! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06051 · 93.4th percentile
Published
2010-08-26T20:00Z
EPSS history
Timeline
  • 26 AUG 20:00Z
    Adobe Shockwave Player before 11.5.8.612 does not properly validate an offset value in the pami RIFF chunk in a Director movie, which allows remote attackers…
    cvelistv5