CVE-2010-3976
First published: Tue Oct 19 2010(Updated: )
Untrusted search path vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Flash Player.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Flash Player | <=9.0.277.0 | |
| Adobe Flash Player | =9.0.16 | |
| Adobe Flash Player | =9.0.18d60 | |
| Adobe Flash Player | =9.0.20 | |
| Adobe Flash Player | =9.0.20.0 | |
| Adobe Flash Player | =9.0.28 | |
| Adobe Flash Player | =9.0.28.0 | |
| Adobe Flash Player | =9.0.31 | |
| Adobe Flash Player | =9.0.31.0 | |
| Adobe Flash Player | =9.0.45.0 | |
| Adobe Flash Player | =9.0.47.0 | |
| Adobe Flash Player | =9.0.48.0 | |
| Adobe Flash Player | =9.0.112.0 | |
| Adobe Flash Player | =9.0.114.0 | |
| Adobe Flash Player | =9.0.115.0 | |
| Adobe Flash Player | =9.0.124.0 | |
| Adobe Flash Player | =9.0.125.0 | |
| Adobe Flash Player | =9.0.151.0 | |
| Adobe Flash Player | =9.0.152.0 | |
| Adobe Flash Player | =9.0.155.0 | |
| Adobe Flash Player | =9.0.159.0 | |
| Adobe Flash Player | =9.0.246.0 | |
| Adobe Flash Player | =9.0.260.0 | |
| Adobe Flash Player | =9.0.262.0 | |
| Microsoft Windows | ||
| Adobe Flash Player | <=10.1.92.10 | |
| Adobe Flash Player | =10.0.0.584 | |
| Adobe Flash Player | =10.0.12.10 | |
| Adobe Flash Player | =10.0.12.36 | |
| Adobe Flash Player | =10.0.15.3 | |
| Adobe Flash Player | =10.0.22.87 | |
| Adobe Flash Player | =10.0.32.18 | |
| Adobe Flash Player | =10.0.42.34 | |
| Adobe Flash Player | =10.0.45.2 | |
| Adobe Flash Player | =10.1.52.14.1 | |
| Adobe Flash Player | =10.1.52.15 | |
| Adobe Flash Player | =10.1.53.64 | |
| Adobe Flash Player | =10.1.82.76 | |
| Adobe Flash Player | =10.1.85.3 | |
| Adobe Flash Player | =10.1.92.8 | |
| Adobe Flash Player | =10.1.95.1 | |
| Adobe Flash Player | =10.1.95.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/%5Bflash_player%5D_10.1.x_insecure_dll_hijacking_%28dwmapi.dll%29
- http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2010-09/msg00070.html
- http://www.acrossecurity.com/aspr/ASPR-2010-11-05-1-PUB.txt
- http://www.securityfocus.com/bid/44671
- http://www.adobe.com/support/security/bulletins/apsb10-26.html
- http://support.apple.com/kb/HT4435
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
- http://www.vupen.com/english/advisories/2010/2903
- http://security.gentoo.org/glsa/glsa-201101-09.xml
- http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html
- http://www.vupen.com/english/advisories/2011/0192
- http://secunia.com/advisories/43026
- http://marc.info/?l=bugtraq&m=130331642631603&w=2
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6926
- http://www.securityfocus.com/archive/1/514653/100/0/threaded
- collector/nvd-historical
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/adobe
- canonical/adobe flash player
- version/adobe flash player/9.0.277.0
- version/adobe flash player/9.0.16
- version/adobe flash player/9.0.18d60
- version/adobe flash player/9.0.20
- version/adobe flash player/9.0.20.0
- version/adobe flash player/9.0.28
- version/adobe flash player/9.0.28.0
- version/adobe flash player/9.0.31
- version/adobe flash player/9.0.31.0
- version/adobe flash player/9.0.45.0
- version/adobe flash player/9.0.47.0
- version/adobe flash player/9.0.48.0
- version/adobe flash player/9.0.112.0
- version/adobe flash player/9.0.114.0
- version/adobe flash player/9.0.115.0
- version/adobe flash player/9.0.124.0
- version/adobe flash player/9.0.125.0
- version/adobe flash player/9.0.151.0
- version/adobe flash player/9.0.152.0
- version/adobe flash player/9.0.155.0
- version/adobe flash player/9.0.159.0
- version/adobe flash player/9.0.246.0
- version/adobe flash player/9.0.260.0
- version/adobe flash player/9.0.262.0
- vendor/microsoft
- canonical/microsoft windows
- version/adobe flash player/10.1.92.10
- version/adobe flash player/10.0.0.584
- version/adobe flash player/10.0.12.10
- version/adobe flash player/10.0.12.36
- version/adobe flash player/10.0.15.3
- version/adobe flash player/10.0.22.87
- version/adobe flash player/10.0.32.18
- version/adobe flash player/10.0.42.34
- version/adobe flash player/10.0.45.2
- version/adobe flash player/10.1.52.14.1
- version/adobe flash player/10.1.52.15
- version/adobe flash player/10.1.53.64
- version/adobe flash player/10.1.82.76
- version/adobe flash player/10.1.85.3
- version/adobe flash player/10.1.92.8
- version/adobe flash player/10.1.95.1
- version/adobe flash player/10.1.95.2