CVE-2010-2164
Use-after-free vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecified vectors related to an unspecified "image type within a…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (7.44%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Use-after-free vulnerability in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecified vectors related to an unspecified "image type within a certain function."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 7.44% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- adobe/flash player · macromedia/flash player · adobe/air
- Source
- psirt@adobe.com
References
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=872
- http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
- http://secunia.com/advisories/40144Vendor Advisory
- http://secunia.com/advisories/40545Vendor Advisory
- http://secunia.com/advisories/43026Vendor Advisory
- http://security.gentoo.org/glsa/glsa-201101-09.xml
- http://securitytracker.com/id?1024085
- http://securitytracker.com/id?1024086
- http://support.apple.com/kb/HT4435
- http://www.adobe.com/support/security/bulletins/apsb10-14.htmlPatch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2010-0464.html
- http://www.redhat.com/support/errata/RHSA-2010-0470.html
- http://www.securityfocus.com/bid/40759
- http://www.securityfocus.com/bid/40780
- http://www.turbolinux.co.jp/security/2010/TLSA-2010-19j.txt
- http://www.us-cert.gov/cas/techalerts/TA10-162A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2010/1421Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1432Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1434Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1453Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1482Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1522Vendor Advisory
- http://www.vupen.com/english/advisories/2010/1793Vendor Advisory
- http://www.vupen.com/english/advisories/2011/0192Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15798
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6765
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.