CVE-2010-3654

Published: Oct 29, 2010Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris and 10.1.95.1 on Android, and authplay.dll (aka AuthPlayLib.bundle or libauthplay.so.0.0.0) in Adobe Reader and Acrobat 9.x through 9.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted SWF content, as exploited in the wild in October 2010.

Affected (90)

Products: Adobe: Flash Player, Acrobat, Acrobat Reader · Macromedia: Flash Player

3 products

1 product

Configuration A

1 vulnerable · 4 platform

Vulnerable Software	Affected Versions
Adobe Flash Player	Up to 10.1.85.3

Running on/with	Platform Versions
Apple Mac Os X	All versions
Linux Linux Kernel	All versions
Microsoft Windows	All versions
Oracle Solaris	All versions

Configuration B

65 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Adobe Flash Player	Up to 10.1.95.2
Adobe Flash Player	Version 10.0.0.584
Adobe Flash Player	Version 10.0.12.10
Adobe Flash Player	Version 10.0.12.36
Adobe Flash Player	Version 10.0.15.3
Adobe Flash Player	Version 10.0.22.87
Adobe Flash Player	Version 10.0.32.18
Adobe Flash Player	Version 10.0.42.34
Adobe Flash Player	Version 10.0.45.2
Adobe Flash Player	Version 10.1.52.14.1
Adobe Flash Player	Version 10.1.52.15
Adobe Flash Player	Version 10.1.53.64
Adobe Flash Player	Version 10.1.82.76
Adobe Flash Player	Version 10.1.85.3
Adobe Flash Player	Version 10.1.92.10
Adobe Flash Player	Version 10.1.92.8
Adobe Flash Player	Version 6.0.21.0
Adobe Flash Player	Version 6.0.79
Adobe Flash Player	Version 7.0.1
Adobe Flash Player	Version 7.0.25
Adobe Flash Player	Version 7.0.63
Adobe Flash Player	Version 7.0.69.0
Adobe Flash Player	Version 7.0.70.0
Adobe Flash Player	Version 7.0
Adobe Flash Player	Version 7.1.1
Adobe Flash Player	Version 7.1
Adobe Flash Player	Version 7.2
Adobe Flash Player	Version 8.0.22.0
Adobe Flash Player	Version 8.0.24.0
Adobe Flash Player	Version 8.0.33.0
Adobe Flash Player	Version 8.0.34.0
Adobe Flash Player	Version 8.0.35.0
Adobe Flash Player	Version 8.0.39.0
Adobe Flash Player	Version 8.0.42.0
Adobe Flash Player	Version 8.0
Adobe Flash Player	Version 9.0.112.0
Adobe Flash Player	Version 9.0.114.0
Adobe Flash Player	Version 9.0.115.0
Adobe Flash Player	Version 9.0.124.0
Adobe Flash Player	Version 9.0.125.0
Adobe Flash Player	Version 9.0.151.0
Adobe Flash Player	Version 9.0.152.0
Adobe Flash Player	Version 9.0.159.0
Adobe Flash Player	Version 9.0.16
Adobe Flash Player	Version 9.0.18d60
Adobe Flash Player	Version 9.0.20.0
Adobe Flash Player	Version 9.0.20
Adobe Flash Player	Version 9.0.246.0
Adobe Flash Player	Version 9.0.260.0
Adobe Flash Player	Version 9.0.28.0
Adobe Flash Player	Version 9.0.28
Adobe Flash Player	Version 9.0.31.0
Adobe Flash Player	Version 9.0.31
Adobe Flash Player	Version 9.0.45.0
Adobe Flash Player	Version 9.0.47.0
Adobe Flash Player	Version 9.0.48.0
Adobe Flash Player	Version 9.125.0
Macromedia Flash Player	Version 5.0
Macromedia Flash Player	Version 5.0_r50
Macromedia Flash Player	Version 6.0.29.0
Macromedia Flash Player	Version 6.0.40.0
Macromedia Flash Player	Version 6.0.47.0
Macromedia Flash Player	Version 6.0.65.0
Macromedia Flash Player	Version 6.0.79.0
Macromedia Flash Player	Version 6.0

Running on/with	Platform Versions
Google Android	All versions

Configuration C

24 vulnerable

Vulnerable Software	Affected Versions
Adobe Acrobat	Version 9.0
Adobe Acrobat	Version 9.1.1
Adobe Acrobat	Version 9.1.2
Adobe Acrobat	Version 9.1.3
Adobe Acrobat	Version 9.1
Adobe Acrobat	Version 9.2
Adobe Acrobat	Version 9.3.1
Adobe Acrobat	Version 9.3.2
Adobe Acrobat	Version 9.3.3
Adobe Acrobat	Version 9.3.4
Adobe Acrobat	Version 9.3
Adobe Acrobat	Version 9.4
Adobe Acrobat Reader	Version 9.0
Adobe Acrobat Reader	Version 9.1.1
Adobe Acrobat Reader	Version 9.1.2
Adobe Acrobat Reader	Version 9.1.3
Adobe Acrobat Reader	Version 9.1
Adobe Acrobat Reader	Version 9.2
Adobe Acrobat Reader	Version 9.3.1
Adobe Acrobat Reader	Version 9.3.2
Adobe Acrobat Reader	Version 9.3.3
Adobe Acrobat Reader	Version 9.3.4
Adobe Acrobat Reader	Version 9.3
Adobe Acrobat Reader	Version 9.4

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (74)

http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1

Source: psirt@adobe.com

http://contagiodump.blogspot.com/2010/10/potential-new-adobe-flash-player-zero.html

Source: psirt@adobe.com

Exploit

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

Source: psirt@adobe.com

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html

Source: psirt@adobe.com

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00001.html

Source: psirt@adobe.com

http://secunia.com/advisories/41917

Source: psirt@adobe.com

Vendor Advisory

http://secunia.com/advisories/42030

Source: psirt@adobe.com

http://secunia.com/advisories/42183

Source: psirt@adobe.com

http://secunia.com/advisories/42401

Source: psirt@adobe.com

http://secunia.com/advisories/42926

Source: psirt@adobe.com

http://secunia.com/advisories/43025

Source: psirt@adobe.com

http://secunia.com/advisories/43026

Source: psirt@adobe.com

http://security.gentoo.org/glsa/glsa-201101-08.xml

Source: psirt@adobe.com

http://security.gentoo.org/glsa/glsa-201101-09.xml

Source: psirt@adobe.com

http://securityreason.com/securityalert/8210

Source: psirt@adobe.com

http://support.apple.com/kb/HT4435

Source: psirt@adobe.com

http://www.adobe.com/support/security/advisories/apsa10-05.html

Source: psirt@adobe.com

Vendor Advisory

http://www.adobe.com/support/security/bulletins/apsb10-26.html

Source: psirt@adobe.com

http://www.adobe.com/support/security/bulletins/apsb10-28.html

Source: psirt@adobe.com

http://www.kb.cert.org/vuls/id/298081

Source: psirt@adobe.com

US Government Resource

http://www.redhat.com/support/errata/RHSA-2010-0829.html

Source: psirt@adobe.com

http://www.redhat.com/support/errata/RHSA-2010-0834.html

Source: psirt@adobe.com

http://www.redhat.com/support/errata/RHSA-2010-0867.html

Source: psirt@adobe.com

http://www.redhat.com/support/errata/RHSA-2010-0934.html

Source: psirt@adobe.com

http://www.securityfocus.com/bid/44504

Source: psirt@adobe.com

http://www.securitytracker.com/id?1024659

Source: psirt@adobe.com

http://www.securitytracker.com/id?1024660

Source: psirt@adobe.com

http://www.turbolinux.co.jp/security/2011/TLSA-2011-2j.txt

Source: psirt@adobe.com

http://www.vupen.com/english/advisories/2010/2903

Source: psirt@adobe.com

http://www.vupen.com/english/advisories/2010/2906

Source: psirt@adobe.com

http://www.vupen.com/english/advisories/2010/2918

Source: psirt@adobe.com

http://www.vupen.com/english/advisories/2010/3111

Source: psirt@adobe.com

http://www.vupen.com/english/advisories/2011/0173

Source: psirt@adobe.com

http://www.vupen.com/english/advisories/2011/0191

Source: psirt@adobe.com

http://www.vupen.com/english/advisories/2011/0192

Source: psirt@adobe.com

http://www.vupen.com/english/advisories/2011/0344

Source: psirt@adobe.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13294

Source: psirt@adobe.com

http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1