Vulnerability Details : CVE-2010-3654
Public exploit exists!
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.
Vulnerability category: OverflowMemory CorruptionExecute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2010-3654
Probability of exploitation activity in the next 30 days: 97.38%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2010-3654
-
Adobe Flash Player "Button" Remote Code Execution
Disclosure Date: 2010-10-28First seen: 2020-04-26exploit/windows/fileformat/adobe_flashplayer_buttonThis module exploits a vulnerability in the handling of certain SWF movies within versions 9.x and 10.0 of Adobe Flash Player. Adobe Reader and Acrobat are also vulnerable, as are any other applications that may embed Flash player. Arbitrary code execution is achi
CVSS scores for CVE-2010-3654
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2010-3654
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-3654
-
http://securityreason.com/securityalert/8210
Adobe Flash Player < 10.1.53 .64 Action Script Type Confusion Exploit (DEP+ASLR bypass) - CXSecurity.com
-
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
Apple - Lists.apple.com
-
http://www.adobe.com/support/security/bulletins/apsb10-26.html
Adobe - Security Bulletins: APSB10-26 - Security update available for Adobe Flash Player
-
http://www.vupen.com/english/advisories/2010/2918
Webmail | OVH- OVH
-
http://www.kb.cert.org/vuls/id/298081
VU#298081 - Adobe Flash code execution vulnerabilityUS Government Resource
-
http://security.gentoo.org/glsa/glsa-201101-09.xml
Adobe Flash Player: Multiple vulnerabilities (GLSA 201101-09) — Gentoo security
-
http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html
contagio: CVE-2010-3654 Adobe Flash player zero day vulnerabilityExploit
-
http://www.securitytracker.com/id?1024659
Adobe Flash Player Flaw Lets Remote Users Execute Arbitrary Code - SecurityTracker
- http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1
-
http://www.vupen.com/english/advisories/2010/2906
Webmail | OVH- OVH
-
http://www.securityfocus.com/bid/44504
Adobe Acrobat, Reader, and Flash CVE-2010-3654 Remote Code Execution Vulnerability
-
http://www.vupen.com/english/advisories/2011/0344
Webmail | OVH- OVH
-
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html
[security-announce] SUSE Security Announcement: flash-player (SUSE-SA:20
-
http://www.vupen.com/english/advisories/2010/2903
Webmail | OVH- OVH
-
http://support.apple.com/kb/HT4435
We're sorry.
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13294
Repository / Oval Repository
-
http://www.adobe.com/support/security/advisories/apsa10-05.html
Adobe - Security Advisories: APSA10-05 - Security Advisory for Adobe Flash Player, Adobe Reader and AcrobatVendor Advisory
-
http://www.redhat.com/support/errata/RHSA-2010-0867.html
Support
-
http://www.redhat.com/support/errata/RHSA-2010-0829.html
Support
-
http://www.redhat.com/support/errata/RHSA-2010-0934.html
Support
-
http://www.adobe.com/support/security/bulletins/apsb10-28.html
Adobe - Security Bulletins: APSB10-28 - Security updates available for Adobe Reader and Acrobat
-
http://www.securitytracker.com/id?1024660
Adobe Reader and Acrobat Flaw in 'authplay.dll' Lets Remote Users Execute Arbitrary Code - SecurityTracker
-
http://www.vupen.com/english/advisories/2011/0191
Webmail | OVH- OVH
-
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00001.html
[security-announce] SUSE Security Announcement: acoread (SUSE-SA:2010:05
-
http://www.vupen.com/english/advisories/2011/0192
Webmail | OVH- OVH
-
http://security.gentoo.org/glsa/glsa-201101-08.xml
Adobe Reader: Multiple vulnerabilities (GLSA 201101-08) — Gentoo security
- http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt
-
http://www.vupen.com/english/advisories/2011/0173
Webmail | OVH- OVH
-
http://www.redhat.com/support/errata/RHSA-2010-0834.html
Support
-
http://www.vupen.com/english/advisories/2010/3111
Webmail | OVH- OVH
Products affected by CVE-2010-3654
- cpe:2.3:a:adobe:acrobat_reader:9.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat_reader:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:acrobat:9.4:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.18d60:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.31:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.0.12.10:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.0.0.584:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.159.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.0.22.87:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.125.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.0.12.36:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.125.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.260.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.246.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.152.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:9.0.151.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.0.42.34:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.0.15.3:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.0.32.18:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:8.0.42.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:8.0.33.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:6.0.79:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:8.0.22.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.1.52.15:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.1.52.14.1:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.0.45.2:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:6.0.21.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.1.82.76:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.1.92.10:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.53.64:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:adobe:flash_player:10.1.85.3:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:10.1.92.8:*:*:*:*:*:*:*
- cpe:2.3:a:macromedia:flash_player:5.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:macromedia:flash_player:6.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:macromedia:flash_player:5.0_r50:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:macromedia:flash_player:6.0.29.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:macromedia:flash_player:6.0.40.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:macromedia:flash_player:6.0.47.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:macromedia:flash_player:6.0.79.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel
- cpe:2.3:a:macromedia:flash_player:6.0.65.0:*:*:*:*:*:*:*When used together with: Linux » Linux Kernel