CVE-2012-6270

Adobe Shockwave Player through 11.6.8.638 allows remote attackers to trigger installation of a Shockwave Player 10.4.0.025 compatibility feature via a crafted…

published December 20, 2012

CVSS
—
EPSS
2%
Percentile
84.5
In the wild
Unconfirmed
What it is

⚠️ A crafty HTML document can trick Adobe Shockwave Player into installing an outdated compatibility feature! That's like ordering a brand new gadget, but the store sends you last year's model instead! Think of it as a tech-savvy waiter convincing you to swap your fancy meal for a retro dish from the 2000s, just because they claim it’s more 'classic.' This vulnerability allows attackers to leverage a compatibility parameter to install an older version—definitely not what you signed up for! If exploited, an attacker could potentially downgrade your Shockwave Player to an obsolete version, opening the door for various security concerns and leaving your system vulnerable. It's like leaving a back door unlocked, inviting trouble while you’re busy enjoying your digital experience.

Put simply

Think of it as a tech-savvy waiter convincing you to swap your fancy meal for a retro dish from the 2000s, just because they claim it’s more 'classic.' This vulnerability allows attackers to leverage a compatibility parameter to install an older version—definitely not what you signed up for! This vulnerability in Adobe Shockwave Player allows remote attackers to trigger the installation of a legacy version (10.4.0.025) via a crafted HTML document that includes a specific compatibility parameter. This 'downgrading' attack can expose users to older vulnerabilities previously patched in later versions.

What to do

If exploited, an attacker could potentially downgrade your Shockwave Player to an obsolete version, opening the door for various security concerns and leaving your system vulnerable. It's like leaving a back door unlocked, inviting trouble while you’re busy enjoying your digital experience. To protect yourself, make sure to upgrade Adobe Shockwave Player to the latest version available, currently beyond 11.6.8.638. Regularly check for updates and avoid clicking on untrusted links that may contain malicious HTML documents. 🛡️ You can tackle this! Follow these steps, and keep your digital experience safe and sound. You've got this! 💪😊

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02490 · 84.5th percentile
Published
2012-12-20T11:00Z
EPSS history
Timeline
  • 20 DEC 11:00Z
    Adobe Shockwave Player through 11.6.8.638 allows remote attackers to trigger installation of a Shockwave Player 10.4.0.025 compatibility feature via a crafted…
    cvelistv5