SB2011110901 - Multiple vulnerabilities in Adobe Shockwave Player

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Buffer overflow (CVE-ID: CVE-2011-2446)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The DIRapi library in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2448.

2) Buffer overflow (CVE-ID: CVE-2011-2447)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

3) Buffer overflow (CVE-ID: CVE-2011-2448)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The DIRapi library in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-2446.

4) Buffer overflow (CVE-ID: CVE-2011-2449)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The TextXtra module in Adobe Shockwave Player before 11.6.3.633 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Remediation

Install update from vendor's website.

References

• http://www.adobe.com/support/security/bulletins/apsb11-27.html
• http://www.securitytracker.com/id?1026288