73032

http://www.adobe.com/support/security/bulletins/apsb11-17.html

48289

TA11-166A

adobe-shockwave-memory-ce(68051)

The remote Mac OS X host contains a version of Adobe Shockwave Player that is 11.5.9.620 or earlier. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption vulnerabilities affect the     'Dirapi.dll' component that can result in arbitrary code     execution. (CVE-2011-0317, CVE-2011-0318, CVE-2011-0319,     CVE-2011-0320, CVE-2011-2119, CVE-2011-0335,     CVE-2011-2122)

  - An arbitrary code execution vulnerability occurs due to     an unspecified design flaw. (CVE-2011-2108)

  - Multiple integer overflow vulnerabilities affect the     'Dirapi.dll' component that can result in arbitrary code     execution. (CVE-2011-2109)

  - Multiple memory corruption vulnerabilities affect the     'IML32.dll' component that can result in arbitrary code     execution. (CVE-2011-2111, CVE-2011-2115, CVE-2011-2116)

  - Multiple buffer overflow vulnerabilities affect the     'IML32.dll' component that can result in arbitrary code     execution. (CVE-2011-2112)

  - Multiple buffer overflow vulnerabilities affect the     'Shockwave3DAsset' component that can result in     arbitrary code execution. (CVE-2011-2113)

  - Multiple unspecified memory corruption vulnerabilities     can result in arbitrary code execution. (CVE-2011-2114,     CVE-2011-2117, CVE-2011-2124, CVE-2011-2127,     CVE-2011-2128)

  - An input validation vulnerability affects the 'FLV ASSET     Xtra' component that can result in arbitrary code     execution. (CVE-2011-2118)

  - An integer overflow vulnerability affects the     'CursorAsset x32' component that can result in arbitrary     code execution. (CVE-2011-2120)

  - An unspecified integer overflow vulnerability can result     in arbitrary code execution. (CVE-2011-2121)

  - An integer overflow vulnerability affects the 'Shockwave     3D Asset x32' component that can result in arbitrary     code execution. (CVE-2011-2123)

  - A buffer overflow vulnerability affects the     'Dirapix.dll' component that can result in arbitrary     code execution. (CVE-2011-2125)

  - An unspecified buffer overflow vulnerability can result     in arbitrary code execution. (CVE-2011-2126)

The remote Windows host contains a version of Adobe's Shockwave Player that is earlier than 11.6.0.626.  Such versions are potentially affected by the following issues :

  - Multiple memory corruption vulnerabilities affect the     'Dirapi.dll' component that can result in arbitrary code     execution. (CVE-2011-0317, CVE-2011-0318, CVE-2011-0319,     CVE-2011-0320, CVE-2011-2119, CVE-2011-0335,     CVE-2011-2122)

  - An arbitrary code execution vulnerability occurs due to     an unspecified design flaw. (CVE-2011-2108)

  - Multiple integer overflow vulnerabilities affect the     'Dirapi.dll' component that can result in arbitrary code     execution. (CVE-2011-2109)

  - Multiple memory corruption vulnerabilities affect the     'IML32.dll' component that can result in arbitrary code     execution. (CVE-2011-2111, CVE-2011-2115, CVE-2011-2116)

  - Multiple buffer overflow vulnerabilities affect the     'IML32.dll' component that can result in arbitrary code     execution. (CVE-2011-2112)

  - Multiple buffer overflow vulnerabilities affect the     'Shockwave3DAsset' component that can result in     arbitrary code execution. (CVE-2011-2113)

  - Multiple unspecified memory corruption vulnerabilities     can result in arbitrary code execution. (CVE-2011-2114,     CVE-2011-2117, CVE-2011-2124, CVE-2011-2127,     CVE-2011-2128)

  - An input validation vulnerability affects the 'FLV ASSET     Xtra' component that can result in arbitrary code     execution. (CVE-2011-2118)

  - An integer overflow vulnerability affects the     'CursorAsset x32' component that can result in arbitrary     code execution. (CVE-2011-2120)

  - An unspecified integer overflow vulnerability can result     in arbitrary code execution. (CVE-2011-2121)

  - An integer overflow vulnerability affects the 'Shockwave     3D Asset x32' component that can result in arbitrary     code execution. (CVE-2011-2123)

  - A buffer overflow vulnerability affects the     'Dirapix.dll' component that can result in arbitrary     code execution. (CVE-2011-2125)

  - An unspecified buffer overflow vulnerability can result     in arbitrary code execution. (CVE-2011-2126)

ID	Name	Product	Family	Severity
80176	Adobe Shockwave Player <= 11.5.9.620 (APSB11-17) (Mac OS X)	Nessus	MacOS X Local Security Checks	high
55142	Shockwave Player < 11.6.0.626 (APSB11-17)	Nessus	Windows	high

CVE-2011-2127

high

Tenable Plugins

high

high