Adobe Shockwave Player <= 11.5.9.615 (APSB11-01) (Mac OS X)

high Nessus Plugin ID 80175

Language:

Synopsis

The remote Mac OS X host contains a web browser plugin that is affected by multiple vulnerabilities.

Description

The remote Mac OS X host contains a version of Adobe Shockwave Player that is 11.5.9.615 or earlier. It is, therefore, affected by multiple vulnerabilities :

- Several unspecified errors exist in the 'dirapi.dll' module that allow arbitrary code execution.
(CVE-2010-2587, CVE-2010-2588, CVE-2010-4188)

- An error exists in the 'dirapi.dll' module related to an integer overflow that allows arbitrary code execution. (CVE-2010-2589)

- It is reported that a use-after-free error exists in an unspecified compatibility component related to the 'Settings' window and an unloaded, unspecified library.
This error is reported to allow arbitrary code execution when a crafted, malicious website is visited.
(CVE-2010-4092)

- Unspecified errors exist that allow arbitrary code execution or memory corruption. The attack vectors is unspecified. (CVE-2010-4093, CVE-2010-4187, CVE-2010-4190, CVE-2010-4191, CVE-2010-4192, CVE-2010-4306, CVE-2011-0555)

- An input validation error exists in the 'IML32' module that allows arbitrary code execution when processing the global color table size of a GIF image contained in a Director movie. (CVE-2010-4189)

- An unspecified input validation error exists that allows arbitrary code execution through unspecified vectors.
(CVE-2010-4193)

- An unspecified input validation error exists in the 'dirapi.dll' module that allows arbitrary code execution through unspecified vectors. (CVE-2010-4194)

- An integer overflow error exists in the '3D Assets' module when parsing 3D assets containing the record type '0xFFFFFF45'. This error allows arbitrary code execution. (CVE-2010-4196)

- An input validation error exists in the 'DEMUX' chunks parsing portion of the 'TextXtra.x32' module. This error allows arbitrary code execution. (CVE-2010-4195)

- An unspecified buffer overflow error exists that allows arbitrary code execution through unspecified vectors.
(CVE-2010-4307)

- An error exists in the 'PFR1' chunks parsing portion of the 'Font Xtra.x32' module. This error allows arbitrary code execution. (CVE-2011-0556)

- An unspecified integer overflow error exists that allows arbitrary code execution through unspecified vectors (CVE-2011-0557)

- An error exists in the 'Font Xtra.x32' module related to signedness that allows arbitrary code execution.
(CVE-2011-0569)

Solution

Upgrade to Adobe Shockwave 11.5.9.620 or later.

Plugin Details

Severity: High

ID: 80175

File Name: macosx_shockwave_player_apsb11-01.nasl

Version: 1.5

Type: local

Agent: macosx

Family: MacOS X Local Security Checks

Published: 12/22/2014

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2011-0569

Vulnerability Information

CPE: cpe:/a:adobe:shockwave_player

Required KB Items: installed_sw/Shockwave Player, Host/MacOSX/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 2/8/2011

Vulnerability Publication Date: 2/8/2011

Reference Information

CVE: CVE-2010-2587, CVE-2010-2588, CVE-2010-2589, CVE-2010-4092, CVE-2010-4093, CVE-2010-4187, CVE-2010-4188, CVE-2010-4189, CVE-2010-4190, CVE-2010-4191, CVE-2010-4192, CVE-2010-4193, CVE-2010-4194, CVE-2010-4195, CVE-2010-4196, CVE-2010-4306, CVE-2010-4307, CVE-2011-0555, CVE-2011-0556, CVE-2011-0557, CVE-2011-0569

BID: 44617, 46316, 46317, 46318, 46319, 46320, 46321, 46324, 46325, 46326, 46327, 46328, 46329, 46330, 46332, 46333, 46334, 46335, 46336, 46338, 46339

SECUNIA: 42112

Detections

Analytics