CVE-2010-1297
HIGHCVSS 7.8/10Actively ExploitedEPSS 82.30%
Last modified
CVE-2010-1297 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.. CISA has confirmed active exploitation in the wild. EPSS estimates a 82.30% chance of exploitation in the next 30 days.
Description
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
Metrics
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Adobe | Air | < 2.0.2.12610 | — |
| Adobe | Flash Player | < 9.0.277.0 | — |
| Adobe | Flash Player | >= 10.0, < 10.1.53.64 | — |
| Adobe | Acrobat | >= 8.0, < 8.2.3 | — |
| Adobe | Acrobat | >= 9.0, < 9.3.3 | — |
| Opensuse | Opensuse | >= 11.0, <= 11.2 | — |
| Suse | Linux Enterprise | 10.0 | Sp3 |
| Suse | Linux Enterprise | 11.0 | — |
References
- https://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlMailing List, Third Party Advisory
- https://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.htmlMailing List, Third Party Advisory
- https://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlMailing List, Third Party Advisory
- https://secunia.com/advisories/40026Broken Link, Vendor Advisory
- https://secunia.com/advisories/40034Broken Link, Vendor Advisory
- https://secunia.com/advisories/40144Broken Link
- https://secunia.com/advisories/40545Broken Link
- https://secunia.com/advisories/43026Broken Link
- https://security.gentoo.org/glsa/glsa-201101-09.xmlThird Party Advisory
- https://securitytracker.com/id?1024057Broken Link, Third Party Advisory, VDB Entry
- https://securitytracker.com/id?1024058Broken Link, Third Party Advisory, VDB Entry
- https://securitytracker.com/id?1024085Broken Link, Third Party Advisory, VDB Entry
- https://securitytracker.com/id?1024086Broken Link, Third Party Advisory, VDB Entry
- https://support.apple.com/kb/HT4435Broken Link
- https://www.exploit-db.com/exploits/13787Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/486225Third Party Advisory, US Government Resource
- https://www.osvdb.org/65141Broken Link
- https://www.securityfocus.com/bid/40586Broken Link, Third Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/40759Broken Link, Third Party Advisory, VDB Entry
- https://www.us-cert.gov/cas/techalerts/TA10-159A.htmlThird Party Advisory, US Government Resource
- https://www.us-cert.gov/cas/techalerts/TA10-162A.htmlThird Party Advisory, US Government Resource
- https://www.vupen.com/english/advisories/2010/1348Broken Link, Vendor Advisory
- https://www.vupen.com/english/advisories/2010/1349Broken Link, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59137Third Party Advisory, VDB Entry
- https://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlMailing List, Third Party Advisory
- https://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.htmlMailing List, Third Party Advisory
- https://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlMailing List, Third Party Advisory
- https://secunia.com/advisories/40026Broken Link, Vendor Advisory
- https://secunia.com/advisories/40034Broken Link, Vendor Advisory
- https://secunia.com/advisories/40144Broken Link
- https://secunia.com/advisories/40545Broken Link
- https://secunia.com/advisories/43026Broken Link
- https://security.gentoo.org/glsa/glsa-201101-09.xmlThird Party Advisory
- https://securitytracker.com/id?1024057Broken Link, Third Party Advisory, VDB Entry
- https://securitytracker.com/id?1024058Broken Link, Third Party Advisory, VDB Entry
- https://securitytracker.com/id?1024085Broken Link, Third Party Advisory, VDB Entry
- https://securitytracker.com/id?1024086Broken Link, Third Party Advisory, VDB Entry
- https://support.apple.com/kb/HT4435Broken Link
- https://www.exploit-db.com/exploits/13787Third Party Advisory, VDB Entry
- https://www.kb.cert.org/vuls/id/486225Third Party Advisory, US Government Resource
- https://www.osvdb.org/65141Broken Link
- https://www.securityfocus.com/bid/40586Broken Link, Third Party Advisory, VDB Entry
- https://www.securityfocus.com/bid/40759Broken Link, Third Party Advisory, VDB Entry
- https://www.us-cert.gov/cas/techalerts/TA10-159A.htmlThird Party Advisory, US Government Resource
- https://www.us-cert.gov/cas/techalerts/TA10-162A.htmlThird Party Advisory, US Government Resource
- https://www.vupen.com/english/advisories/2010/1348Broken Link, Vendor Advisory
- https://www.vupen.com/english/advisories/2010/1349Broken Link, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59137Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-1297US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2010-1297?
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.
How severe is CVE-2010-1297?
CVE-2010-1297 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 82.30% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
How do I fix CVE-2010-1297?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2010
- CVE-2010-1291Adobe Shockwave Player before 11.5.7.609 allows attackers to…
- CVE-2010-1292The implementation of pami RIFF chunk parsing in Adobe Shock…
- CVE-2010-1293Cross-site scripting (XSS) vulnerability in the Administrato…
- CVE-2010-1294Unspecified vulnerability in Adobe ColdFusion 8.0, 8.0.1, an…
- CVE-2010-1295Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.…
- CVE-2010-1296Multiple buffer overflows in Adobe Photoshop CS4 before 11.0…
- CVE-2010-1298Directory traversal vulnerability in view.php in Pulse CMS 1…
- CVE-2010-1299Multiple PHP remote file inclusion vulnerabilities in DynPG …
- CVE-2010-1300SQL injection vulnerability in index.php in Yamamah (aka Dov…
- CVE-2010-1301SQL injection vulnerability in main.php in Centreon 2.1.5 al…
- CVE-2010-1302Directory traversal vulnerability in dwgraphs.php in the Dec…
- CVE-2010-1303Multiple cross-site scripting (XSS) vulnerabilities in the T…
Are you affected by CVE-2010-1297?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST