Adobe Shockwave Player vulnerabilities

174 CVEs affecting Adobe Shockwave Player, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-7103, published 2019-05-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-3653, published 2010-10-26. High severity, CVSS 9.3. EPSS: 74.6% chance of exploitation in the next 30 days. The Director module (dirapi.dll) in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Director movie…
CVE-2007-5941, published 2007-11-14. High severity, CVSS 10.0. EPSS: 32.3% chance of exploitation in the next 30 days. Stack-based buffer overflow in the SWCtl.SWCtl ActiveX control in Adobe Shockwave allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long argument to the…
CVE-2009-3244, published 2009-09-18. High severity, CVSS 9.3. EPSS: 20.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe Shockwave Player 11.5.1.601 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code…
CVE-2005-3525, published 2005-12-31. High severity, CVSS 9.3. EPSS: 19.7% chance of exploitation in the next 30 days. Stack-based buffer overflow in an ActiveX control for the installer for Adobe Macromedia Shockwave Player 10.1.0.11 and earlier allows remote attackers to execute arbitrary code via crafted large…
CVE-2012-2031, published 2012-05-09. High severity, CVSS 10.0. EPSS: 18.1% chance of exploitation in the next 30 days. Adobe Shockwave Player before 11.6.5.635 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2010-1280, published 2010-05-13. High severity, CVSS 8.8. EPSS: 16.6% chance of exploitation in the next 30 days. Adobe Shockwave Player before 11.5.7.609 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file, related to (1) an…
CVE-2010-2866, published 2010-08-26. High severity, CVSS 9.3. EPSS: 13% chance of exploitation in the next 30 days. Integer signedness error in the DIRAPI module in Adobe Shockwave Player before 11.5.8.612 allows remote attackers to cause a denial of service (memory corruption) or execute arbitrary code via a…
CVE-2010-0987, published 2010-05-13. High severity, CVSS 8.8. EPSS: 11.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in Adobe Shockwave Player before 11.5.7.609 might allow remote attackers to execute arbitrary code via crafted embedded fonts in a Shockwave file.
CVE-2012-4172, published 2012-10-23. High severity, CVSS 10.0. EPSS: 9.7% chance of exploitation in the next 30 days. Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4173, CVE-2012-4174,…
CVE-2012-4175, published 2012-10-23. High severity, CVSS 10.0. EPSS: 9.6% chance of exploitation in the next 30 days. Buffer overflow in Adobe Shockwave Player before 11.6.8.638 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2012-4172, CVE-2012-4173,…

Latest

CVE-2019-7103, published 2019-05-23. Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days. Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7102, published 2019-05-23. Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days. Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7101, published 2019-05-23. Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days. Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7100, published 2019-05-23. Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days. Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7099, published 2019-05-23. Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days. Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7098, published 2019-05-23. Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days. Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-7104, published 2019-05-23. Critical severity, CVSS 9.8. EPSS: 5.1% chance of exploitation in the next 30 days. Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2012-0771, published 2018-02-19. High severity, CVSS 8.8. EPSS: 5% chance of exploitation in the next 30 days. Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than…
CVE-2017-3086, published 2017-06-20. Critical severity, CVSS 9.8. EPSS: 6.9% chance of exploitation in the next 30 days. Adobe Shockwave versions 12.2.8.198 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2017-2983, published 2017-03-14. High severity, CVSS 7.8. EPSS: 3% chance of exploitation in the next 30 days. Adobe Shockwave versions 12.2.7.197 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful exploitation could lead to escalation of privilege.