CVE Feed

    Dashboard / CVE / CVE-2010-1297

    CVE-2010-1297

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

    Published:Jun 4, 2010
    Last Modified:Apr 21, 2026
    EPS:Jun 8, 2010
    EPSS Score:0.92986
    CVSS Score:7.8

    CISA Notification

    Description

    Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

    Required Action:

    The impacted product is end-of-life and should be disconnected if still in use.

    Notes:

    No extra notes provided.

    Due Date
    Jun 22, 2022
    1542 days ago
    Alert Date
    Jun 8, 2022
    1556 days ago

    Affected Products

    Vendor
    Adobe
    Product
    Acrobat
    Vendor
    Adobe
    Product
    Air
    Vendor
    Adobe
    Product
    Flash Player
    Vendor
    Apple
    Product
    Mac Os X
    Vendor
    Microsoft
    Product
    Windows
    Vendor
    Opensuse
    Product
    Opensuse
    Vendor
    Redhat
    Product
    Rhel Extras
    Vendor
    Suse
    Product
    Linux Enterprise

    Exploits

    http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/https://www.exploit-db.com/exploits/13787https://www.exploit-db.com/exploits/14853https://www.exploit-db.com/exploits/16614https://www.exploit-db.com/exploits/16687

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-81984 (CVSS 5.5) — Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory…
    CVE-2026-81989 (CVSS 7.8) — Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in …
    CVE-2026-81991 (CVSS 5.5) — Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m…
    CVE-2026-81980 (CVSS 7.8) — Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code executi…
    CVE-2026-81990 (CVSS 7.8) — Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in …
    CVE-2026-81987 (CVSS 7.8) — Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary c…
    CVE-2026-79910 (CVSS 5.5) — Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive m…
    CVE-2026-81993 (CVSS 5.5) — Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could lead to disclosure of sens…
    CVE-2026-79907 (CVSS 7.8) — Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the…
    CVE-2026-79909 (CVSS 7.8) — Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in …

    References

    http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/
    http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspx
    http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751
    http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
    http://secunia.com/advisories/40026
    http://secunia.com/advisories/40034
    http://secunia.com/advisories/40144
    http://secunia.com/advisories/40545
    http://secunia.com/advisories/43026
    http://security.gentoo.org/glsa/glsa-201101-09.xml
    http://securitytracker.com/id?1024057
    http://securitytracker.com/id?1024058
    http://securitytracker.com/id?1024085
    http://securitytracker.com/id?1024086
    http://support.apple.com/kb/HT4435
    http://www.adobe.com/support/security/advisories/apsa10-01.html
    http://www.adobe.com/support/security/bulletins/apsb10-14.html
    http://www.adobe.com/support/security/bulletins/apsb10-15.html
    http://www.exploit-db.com/exploits/13787
    http://www.kb.cert.org/vuls/id/486225
    http://www.osvdb.org/65141
    http://www.redhat.com/support/errata/RHSA-2010-0464.html
    http://www.redhat.com/support/errata/RHSA-2010-0470.html
    http://www.securityfocus.com/bid/40586
    http://www.securityfocus.com/bid/40759
    http://www.turbolinux.co.jp/security/2010/TLSA-2010-19j.txt
    http://www.us-cert.gov/cas/techalerts/TA10-159A.html
    http://www.us-cert.gov/cas/techalerts/TA10-162A.html
    http://www.vupen.com/english/advisories/2010/1348
    http://www.vupen.com/english/advisories/2010/1349
    http://www.vupen.com/english/advisories/2010/1421
    http://www.vupen.com/english/advisories/2010/1432
    http://www.vupen.com/english/advisories/2010/1434
    http://www.vupen.com/english/advisories/2010/1453
    http://www.vupen.com/english/advisories/2010/1482
    http://www.vupen.com/english/advisories/2010/1522
    http://www.vupen.com/english/advisories/2010/1636
    http://www.vupen.com/english/advisories/2010/1793
    http://www.vupen.com/english/advisories/2011/0192
    https://exchange.xforce.ibmcloud.com/vulnerabilities/59137
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7116
    http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/
    http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspx
    http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751
    http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html
    http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
    http://secunia.com/advisories/40026
    http://secunia.com/advisories/40034
    http://secunia.com/advisories/40144
    http://secunia.com/advisories/40545
    http://secunia.com/advisories/43026
    http://security.gentoo.org/glsa/glsa-201101-09.xml
    http://securitytracker.com/id?1024057
    http://securitytracker.com/id?1024058
    http://securitytracker.com/id?1024085
    http://securitytracker.com/id?1024086
    http://support.apple.com/kb/HT4435
    http://www.adobe.com/support/security/advisories/apsa10-01.html
    http://www.adobe.com/support/security/bulletins/apsb10-14.html
    http://www.adobe.com/support/security/bulletins/apsb10-15.html
    http://www.exploit-db.com/exploits/13787
    http://www.kb.cert.org/vuls/id/486225
    http://www.osvdb.org/65141
    http://www.redhat.com/support/errata/RHSA-2010-0464.html
    http://www.redhat.com/support/errata/RHSA-2010-0470.html
    http://www.securityfocus.com/bid/40586
    http://www.securityfocus.com/bid/40759
    http://www.turbolinux.co.jp/security/2010/TLSA-2010-19j.txt
    http://www.us-cert.gov/cas/techalerts/TA10-159A.html
    http://www.us-cert.gov/cas/techalerts/TA10-162A.html
    http://www.vupen.com/english/advisories/2010/1348
    http://www.vupen.com/english/advisories/2010/1349
    http://www.vupen.com/english/advisories/2010/1421
    http://www.vupen.com/english/advisories/2010/1432
    http://www.vupen.com/english/advisories/2010/1434
    http://www.vupen.com/english/advisories/2010/1453
    http://www.vupen.com/english/advisories/2010/1482
    http://www.vupen.com/english/advisories/2010/1522
    http://www.vupen.com/english/advisories/2010/1636
    http://www.vupen.com/english/advisories/2010/1793
    http://www.vupen.com/english/advisories/2011/0192
    https://exchange.xforce.ibmcloud.com/vulnerabilities/59137
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7116
    https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1297

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High