CVE-2009-4002 Heap-based buffer overflow in Adobe Shockwave Player before 11.5.6.606 allows remote attackers to execute arbitrary code via a crafted 3D model in a Shockwave file.
HighCVSS 9.3
EPSS 8.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap-based buffer overflow in Adobe Shockwave Player before 11.5.6.606 allows remote attackers to execute arbitrary code via a crafted 3D model in a Shockwave file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe shockwave player | <= 11.5.2.602 | No fix listed |
| Adobe shockwave player | = 1.0 | No fix listed |
| Adobe shockwave player | = 2.0 | No fix listed |
| Adobe shockwave player | = 3.0 | No fix listed |
| Adobe shockwave player | = 4.0 | No fix listed |
| Adobe shockwave player | = 5.0 | No fix listed |
| Adobe shockwave player | = 6.0 | No fix listed |
| Adobe shockwave player | = 8.0 | No fix listed |
| Adobe shockwave player | = 8.5.1 | No fix listed |
| Adobe shockwave player | = 9 | No fix listed |
| Adobe shockwave player | = 10.1.0.11 | No fix listed |
| Adobe shockwave player | = 11.0.0.456 | No fix listed |
| Adobe shockwave player | = 11.5.0.595 | No fix listed |
| Adobe shockwave player | = 11.5.0.596 | No fix listed |
| Adobe shockwave player | = 11.5.1.601 | No fix listed |
References
- 37888 third-party-advisory vendor-advisory
- secunia.com vendor-advisory
- 1023481 vdb-entry
- www.adobe.com patch vendor-advisory
- 20100120 Secunia Research: Adobe Shockwave Player 3D Model Buffer Overflow mailing-list
- 37870 vdb-entry
- ADV-2010-0171 patch vdb-entry vendor-advisory
- shockwave-3d-bo(55758) vdb-entry
- oval:org.mitre.oval:def:8311 signature vdb-entry