National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

CVE-2010-2188 Detail

Description

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by calling the ActionScript native object 2200 connect method multiple times with different arguments, a different vulnerability than CVE-2010-2160, CVE-2010-2165, CVE-2010-2166, CVE-2010-2171, CVE-2010-2175, CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2180, CVE-2010-2182, CVE-2010-2184, and CVE-2010-2187.

Source:  MITRE      Last Modified:  06/15/2010

Quick Info

CVE Dictionary Entry:
CVE-2010-2188
Original release date:
06/15/2010
Last revised:
09/18/2017
Source:
US-CERT/NIST

Impact

CVSS Severity (version 2.0):
CVSS v2 Base Score:
9.3 HIGH
Vector:
(AV:N/AC:M/Au:N/C:C/I:C/A:C) (legend)
Impact Subscore:
10.0
Exploitability Subscore:
8.6
CVSS Version 2 Metrics:
Access Vector:
Network exploitable - Victim must voluntarily interact with attack mechanism
Access Complexity:
Medium
Authentication:
Not required to exploit
Impact Type:
Allows unauthorized disclosure of information; Allows unauthorized modification; Allows disruption of service

Evaluator Impact

Per: http://www.adobe.com/support/security/bulletins/apsb10-14.html 'Affected software versions Adobe Flash Player 10.0.45.2 and earlier versions for Windows, Macintosh, Linux and Solaris Adobe AIR 1.5.3.9130 and earlier versions for Windows, Macintosh and Linux'

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource Type Source Name
http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751 External Source HP HPSBMA02547
http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html External Source APPLE APPLE-SA-2010-11-10-1
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html External Source SUSE SUSE-SA:2010:024
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html External Source SUSE SUSE-SR:2010:013
http://security.gentoo.org/glsa/glsa-201101-09.xml External Source GENTOO GLSA-201101-09
http://securitytracker.com/id?1024085 External Source SECTRACK 1024085
http://securitytracker.com/id?1024086 External Source SECTRACK 1024086
http://support.apple.com/kb/HT4435 External Source CONFIRM http://support.apple.com/kb/HT4435
http://www.adobe.com/support/security/bulletins/apsb10-14.html Patch; Vendor Advisory External Source CONFIRM http://www.adobe.com/support/security/bulletins/apsb10-14.html
http://www.adobe.com/support/security/bulletins/apsb10-16.html External Source CONFIRM http://www.adobe.com/support/security/bulletins/apsb10-16.html
http://www.redhat.com/support/errata/RHSA-2010-0464.html External Source REDHAT RHSA-2010:0464
http://www.redhat.com/support/errata/RHSA-2010-0470.html External Source REDHAT RHSA-2010:0470
http://www.securityfocus.com/archive/1/archive/1/511924/100/0/threaded External Source BUGTRAQ 20100621 ZDI-10-111: Adobe Flash Player LocalConnection Memory Corruption Remote Code Execution Vulnerability
http://www.securityfocus.com/bid/40759 External Source BID 40759
http://www.securityfocus.com/bid/40798 External Source BID 40798
http://www.turbolinux.co.jp/security/2010/TLSA-2010-19j.txt External Source TURBO TLSA-2010-19
http://www.us-cert.gov/cas/techalerts/TA10-162A.html US Government Resource External Source CERT TA10-162A
http://www.vupen.com/english/advisories/2010/1421 External Source VUPEN ADV-2010-1421
http://www.vupen.com/english/advisories/2010/1432 External Source VUPEN ADV-2010-1432
http://www.vupen.com/english/advisories/2010/1434 External Source VUPEN ADV-2010-1434
http://www.vupen.com/english/advisories/2010/1453 External Source VUPEN ADV-2010-1453
http://www.vupen.com/english/advisories/2010/1482 External Source VUPEN ADV-2010-1482
http://www.vupen.com/english/advisories/2010/1522 External Source VUPEN ADV-2010-1522
http://www.vupen.com/english/advisories/2010/1793 External Source VUPEN ADV-2010-1793
http://www.vupen.com/english/advisories/2011/0192 External Source VUPEN ADV-2011-0192
http://www.zerodayinitiative.com/advisories/ZDI-10-111 External Source MISC http://www.zerodayinitiative.com/advisories/ZDI-10-111
https://exchange.xforce.ibmcloud.com/vulnerabilities/59337 External Source XF adobe-fpair-memory-code-exec(59337)
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16271 External Source OVAL oval:org.mitre.oval:def:16271
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6946 External Source OVAL oval:org.mitre.oval:def:6946

References to Check Content

Identifier:
oval:org.mitre.oval:def:6946
Check System:
http://oval.mitre.org/XMLSchema/oval-definitions-5
Hyperlink:
http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:6946

Technical Details

Vulnerability Type (View All)

Vulnerable software and versions Switch to CPE 2.2

Configuration 1
OR
cpe:2.3:a:adobe:flash_player:9.0.16:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.20:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.20.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.28:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.28.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.31:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.31.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.45.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.47.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.48.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.124.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.125.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.151.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.152.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.159.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.246.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.260.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:9.0.262.0:*:*:*:*:*:*:*
Configuration 2
OR
cpe:2.3:a:adobe:flash_player:10.0.0.584:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.12.10:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.12.36:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.15.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.22.87:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.32.18:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:10.0.42.34:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*    versions up to (including) 10.0.45.2
Configuration 3
OR
cpe:2.3:a:adobe:flash_player:6.0.79:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.14.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.19.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.24.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.53.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.60.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.61.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.66.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.67.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.68.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.0.73.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.22.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.33.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:8.0.42.0:*:*:*:*:*:*:*
cpe:2.3:a:macromedia:flash_player:5.0:*:*:*:*:*:*:*
cpe:2.3:a:macromedia:flash_player:5.0.30.0:*:*:*:*:*:*:*
cpe:2.3:a:macromedia:flash_player:5.0.41.0:*:*:*:*:*:*:*
cpe:2.3:a:macromedia:flash_player:5.0.42.0:*:*:*:*:*:*:*
cpe:2.3:a:macromedia:flash_player:5.0.58.0:*:*:*:*:*:*:*
Configuration 4
OR
cpe:2.3:a:adobe:air:1.0:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:1.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:1.5:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:1.5.2:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:1.5.3:*:*:*:*:*:*:*
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*    versions up to (including) 1.5.3.9130

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History 4 change records found - show changes