Read the docs
TI-2010-02749 Aliases CVE-2010-2873GHSA-p9wv-xg3r-33r2

Adobe Shockwave Player before 11.5.8.612 does not properly validate offset values in the…

Priority MEDIUM 49CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Adobe Shockwave Player before 11.5.8.612 does not properly validate offset values in the rcsL RIFF chunks of (1) .DIR and (2) .DCR Director movies, which allows remote attackers to cause a denial of service (heap memory corruption) or execute arbitrary code via a crafted movie.

Why it matters now

EPSS 0.06246 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 40

CPEVersionsRoleVendor
cpe:2.3:a:adobe:shockwave_player:*:*:*:*:*:*:*:*up to 11.5.7.609VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:1.0:*:*:*:*:*:*:*1.0VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:2.0:*:*:*:*:*:*:*2.0VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:3.0:*:*:*:*:*:*:*3.0VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:4.0:*:*:*:*:*:*:*4.0VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:5.0:*:*:*:*:*:*:*5.0VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:6.0:*:*:*:*:*:*:*6.0VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.0:*:*:*:*:*:*:*8.0VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.0.196:*:*:*:*:*:*:*8.0.196VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.0.196a:*:*:*:*:*:*:*8.0.196aVulnerableAdobe
  • cpe:2.3:a:adobe:shockwave_player:*:*:*:*:*:*:*:* Versions up to 11.5.7.609 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.0.196:*:*:*:*:*:*:* Versions 8.0.196 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.0.196a:*:*:*:*:*:*:* Versions 8.0.196a Vulnerable ·Adobe
Show 30 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:adobe:shockwave_player:8.0.204:*:*:*:*:*:*:*8.0.204VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.0.205:*:*:*:*:*:*:*8.0.205VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.5.1:*:*:*:*:*:*:*8.5.1VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.5.1.100:*:*:*:*:*:*:*8.5.1.100VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.5.1.103:*:*:*:*:*:*:*8.5.1.103VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.5.1.105:*:*:*:*:*:*:*8.5.1.105VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.5.1.106:*:*:*:*:*:*:*8.5.1.106VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.5.321:*:*:*:*:*:*:*8.5.321VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.5.323:*:*:*:*:*:*:*8.5.323VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.5.324:*:*:*:*:*:*:*8.5.324VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:8.5.325:*:*:*:*:*:*:*8.5.325VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:9:*:*:*:*:*:*:*9VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:9.0.383:*:*:*:*:*:*:*9.0.383VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:9.0.432:*:*:*:*:*:*:*9.0.432VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:10.0.0.210:*:*:*:*:*:*:*10.0.0.210VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:10.0.1.004:*:*:*:*:*:*:*10.0.1.004VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:10.1.0.11:*:*:*:*:*:*:*10.1.0.11VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:10.1.0.011:*:*:*:*:*:*:*10.1.0.011VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:10.1.1.016:*:*:*:*:*:*:*10.1.1.016VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:10.1.4.020:*:*:*:*:*:*:*10.1.4.020VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:10.2.0.021:*:*:*:*:*:*:*10.2.0.021VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:10.2.0.022:*:*:*:*:*:*:*10.2.0.022VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:10.2.0.023:*:*:*:*:*:*:*10.2.0.023VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:11.0.0.456:*:*:*:*:*:*:*11.0.0.456VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:11.0.3.471:*:*:*:*:*:*:*11.0.3.471VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:11.5.0.595:*:*:*:*:*:*:*11.5.0.595VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:11.5.0.596:*:*:*:*:*:*:*11.5.0.596VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:11.5.1.601:*:*:*:*:*:*:*11.5.1.601VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:11.5.2.602:*:*:*:*:*:*:*11.5.2.602VulnerableAdobe
cpe:2.3:a:adobe:shockwave_player:11.5.6.606:*:*:*:*:*:*:*11.5.6.606VulnerableAdobe
  • cpe:2.3:a:adobe:shockwave_player:8.0.204:*:*:*:*:*:*:* Versions 8.0.204 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.0.205:*:*:*:*:*:*:* Versions 8.0.205 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.5.1.100:*:*:*:*:*:*:* Versions 8.5.1.100 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.5.1.103:*:*:*:*:*:*:* Versions 8.5.1.103 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.5.1.105:*:*:*:*:*:*:* Versions 8.5.1.105 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.5.1.106:*:*:*:*:*:*:* Versions 8.5.1.106 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.5.321:*:*:*:*:*:*:* Versions 8.5.321 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.5.323:*:*:*:*:*:*:* Versions 8.5.323 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.5.324:*:*:*:*:*:*:* Versions 8.5.324 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:8.5.325:*:*:*:*:*:*:* Versions 8.5.325 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:9:*:*:*:*:*:*:* Versions 9 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:9.0.383:*:*:*:*:*:*:* Versions 9.0.383 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:9.0.432:*:*:*:*:*:*:* Versions 9.0.432 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:10.0.0.210:*:*:*:*:*:*:* Versions 10.0.0.210 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:10.0.1.004:*:*:*:*:*:*:* Versions 10.0.1.004 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:10.1.0.11:*:*:*:*:*:*:* Versions 10.1.0.11 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:10.1.0.011:*:*:*:*:*:*:* Versions 10.1.0.011 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:10.1.1.016:*:*:*:*:*:*:* Versions 10.1.1.016 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:10.1.4.020:*:*:*:*:*:*:* Versions 10.1.4.020 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:10.2.0.021:*:*:*:*:*:*:* Versions 10.2.0.021 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:10.2.0.022:*:*:*:*:*:*:* Versions 10.2.0.022 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:10.2.0.023:*:*:*:*:*:*:* Versions 10.2.0.023 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:11.0.0.456:*:*:*:*:*:*:* Versions 11.0.0.456 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:11.0.3.471:*:*:*:*:*:*:* Versions 11.0.3.471 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:11.5.0.595:*:*:*:*:*:*:* Versions 11.5.0.595 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:11.5.0.596:*:*:*:*:*:*:* Versions 11.5.0.596 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:11.5.1.601:*:*:*:*:*:*:* Versions 11.5.1.601 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:11.5.2.602:*:*:*:*:*:*:* Versions 11.5.2.602 Vulnerable ·Adobe
  • cpe:2.3:a:adobe:shockwave_player:11.5.6.606:*:*:*:*:*:*:* Versions 11.5.6.606 Vulnerable ·Adobe

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-2873
  2. 2026-10-03 Alias added: GHSA-p9wv-xg3r-33r2

References

Patch 1

Other 3

  • TI-2010-03478 The Director module (dirapi.dll) in Adobe Shockwave Player before 11.5.9.615 allows… CVSS 2.0HIGH 9.3
  • TI-2007-05680 Stack-based buffer overflow in the SWCtl.SWCtl ActiveX control in Adobe Shockwave allows… CVSS 2.0HIGH 10.0
  • TI-2012-01804 Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or… CVSS 2.0HIGH 10.0
  • TI-2009-03088 Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player… CVSS 2.0HIGH 9.3
  • TI-2005-03348 Stack-based buffer overflow in an ActiveX control for the installer for Adobe Macromedia… CVSS 2.0HIGH 9.3
  • TI-2013-00529 Stack-based buffer overflow in Adobe Shockwave Player before 12.0.0.112 allows attackers… CVSS 2.0HIGH 10.0
See all 173 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences