Intelligence online17 sources monitored8 actively exploited 7d26 published 24hChecked recently
Vulnerability record

CVE-2010-1297

Adobe Flash Player Memory Corruption Vulnerability

HighExploitation confirmedCISA KEV
What should I do?

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog: attackers are using it. If you run Flash Player, fix it now.

CISA required action: The impacted product is end-of-life and should be disconnected if still in use.

US federal civilian agencies must remediate by Jun 22, 2022.

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations and CISA's required action, limit exposure of affected systems, and watch this record for a patch.

Description

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Affected products

ProductVendorAffected versionsFixed inSource
AcrobatAdobe>= 8.0, < 8.2.3; >= 9.0, < 9.3.38.2.3; 9.3.3NVD
Flash PlayerAdobe< 9.0.277.0; >= 10.0, < 10.1.53.649.0.277.0; 10.1.53.64KEV

Sources: NVD = NIST National Vulnerability Database; KEV = CISA Known Exploited Vulnerabilities catalog.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdateKEV

    CVE-2010-1297 scored CVSS 7.8: Adobe Flash Player, Adobe Flash Player Memory Corruption Vulnerability

    CISA lists this as exploited in the wild. Unpatched Flash Player systems are exposed to active attacks now.

    Basis: NIST National Vulnerability Database

1 earlier event is available with a subscription. See plans.

Coverage

We have not published a story about this vulnerability yet.

References