Back to KEVs

CVE-2010-1297

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and...

Basic Information

CVE State
PUBLISHED
Reserved Date
April 06, 2010
Published Date
June 08, 2010
Last Updated
February 04, 2025
Vendor
Adobe
Product
["Flash Player", "AIR", "Reader", "Acrobat"]
Description
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
Tags
windows macos cisa metasploit_scanner

CVSS Scores

CVSS v3.1

7.8 - HIGH

Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

9.3

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

SSVC Information

Exploitation
active
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (2022-06-08 00:00:00 UTC) Source

References

http://www.vupen.com/english/advisories/2010/1636 http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspx http://www.vupen.com/english/advisories/2010/1349 http://www.adobe.com/support/security/bulletins/apsb10-15.html http://www.vupen.com/english/advisories/2011/0192 http://www.vupen.com/english/advisories/2010/1421 http://support.apple.com/kb/HT4435 http://secunia.com/advisories/40545 http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/ http://www.redhat.com/support/errata/RHSA-2010-0464.html http://www.vupen.com/english/advisories/2010/1793 http://secunia.com/advisories/43026 http://www.vupen.com/english/advisories/2010/1432 http://security.gentoo.org/glsa/glsa-201101-09.xml http://www.us-cert.gov/cas/techalerts/TA10-162A.html http://www.adobe.com/support/security/advisories/apsa10-01.html http://www.kb.cert.org/vuls/id/486225 http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html http://www.securityfocus.com/bid/40759 http://securitytracker.com/id?1024085 http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://securitytracker.com/id?1024057 http://securitytracker.com/id?1024086 http://secunia.com/advisories/40034 http://www.vupen.com/english/advisories/2010/1434 http://www.securityfocus.com/bid/40586 http://www.turbolinux.co.jp/security/2010/TLSA-2010-19j.txt http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html http://securitytracker.com/id?1024058 http://www.vupen.com/english/advisories/2010/1348 http://www.exploit-db.com/exploits/13787 http://www.adobe.com/support/security/bulletins/apsb10-14.html http://www.us-cert.gov/cas/techalerts/TA10-159A.html http://secunia.com/advisories/40144 http://www.redhat.com/support/errata/RHSA-2010-0470.html http://www.vupen.com/english/advisories/2010/1482 http://secunia.com/advisories/40026 https://exchange.xforce.ibmcloud.com/vulnerabilities/59137 http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 http://www.vupen.com/english/advisories/2010/1522 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7116 http://www.osvdb.org/65141 http://www.vupen.com/english/advisories/2010/1453

Known Exploited Vulnerability Information

Source Added Date
CISA 2022-06-08 00:00:00 UTC

Scanner Integrations

Scanner URL Date Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/adobe_flashplayer_newfunction.rb 2025-04-29 11:01:33 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

adobe_flashplayer_newfunction

Type: metasploit • Created: Unknown

Metasploit module for CVE-2010-1297

adobe_flashplayer_newfunction

Type: metasploit • Created: Unknown

Metasploit module for CVE-2010-1297

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Metasploit