CVE-2009-4002

Published: Jan 21, 2010Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Heap-based buffer overflow in Adobe Shockwave Player before 11.5.6.606 allows remote attackers to execute arbitrary code via a crafted 3D model in a Shockwave file.

Affected (15)

Products: Adobe: Shockwave Player

1 product

Shockwave Player

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Adobe Shockwave Player	Up to 11.5.2.602
Adobe Shockwave Player	Version 1.0
Adobe Shockwave Player	Version 10.1.0.11
Adobe Shockwave Player	Version 11.0.0.456
Adobe Shockwave Player	Version 11.5.0.595
Adobe Shockwave Player	Version 11.5.0.596
Adobe Shockwave Player	Version 11.5.1.601
Adobe Shockwave Player	Version 2.0
Adobe Shockwave Player	Version 3.0
Adobe Shockwave Player	Version 4.0
Adobe Shockwave Player	Version 5.0
Adobe Shockwave Player	Version 6.0
Adobe Shockwave Player	Version 8.0
Adobe Shockwave Player	Version 8.5.1
Adobe Shockwave Player	Version 9

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (18)

http://secunia.com/advisories/37888

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://secunia.com/secunia_research/2009-61/

Source: PSIRT-CNA@flexerasoftware.com

Vendor Advisory

http://securitytracker.com/id?1023481

Source: PSIRT-CNA@flexerasoftware.com

http://www.adobe.com/support/security/bulletins/apsb10-03.html

Source: PSIRT-CNA@flexerasoftware.com

PatchVendor Advisory

http://www.securityfocus.com/archive/1/509062/100/0/threaded

Source: PSIRT-CNA@flexerasoftware.com

http://www.securityfocus.com/bid/37870

Source: PSIRT-CNA@flexerasoftware.com

http://www.vupen.com/english/advisories/2010/0171

Source: PSIRT-CNA@flexerasoftware.com

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/55758

Source: PSIRT-CNA@flexerasoftware.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8311

Source: PSIRT-CNA@flexerasoftware.com

http://secunia.com/advisories/37888

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/secunia_research/2009-61/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securitytracker.com/id?1023481

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.adobe.com/support/security/bulletins/apsb10-03.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/archive/1/509062/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/37870

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2010/0171

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/55758

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8311

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.