What’s Vulnerable › Vulnerabilities

CVE-2010-1297: Adobe Flash Player Memory Corruption Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-06-08
• EPSS: 82.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2010-06-08 · updated 2026-06-16
• Weakness: CWE-787

Description

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Affected products

• Adobe Acrobat for Edge: from 8.0 before 8.2.3; from 9.0 before 9.3.3 — fixed in 8.2.3, 9.3.3
• Adobe Air: before 2.0.2.12610 — fixed in 2.0.2.12610
• Adobe Flash Player 24.0.0.186 and earlier.: before 9.0.277.0; from 10.0 before 10.1.53.64 — fixed in 10.1.53.64, 9.0.277.0
• Opensuse: from 11.0 through 11.2
• SUSE Linux Enterprise: 10.0-sp3, 11.0, 11.0-sp1

How to fix

Upgrade to a fixed version: Adobe Acrobat for Edge 8.2.3, 9.3.3; Adobe Air 2.0.2.12610; Adobe Flash Player 24.0.0.186 and earlier. 10.1.53.64, 9.0.277.0. Check the vendor advisory for mitigations.

References

• http://blog.zynamics.com/2010/06/09/analyzing-the-currently-exploited-0-day-for-adobe-reader-and-adobe-flash/
• http://community.websense.com/blogs/securitylabs/archive/2010/06/09/having-fun-with-adobe-0-day-exploits.aspx
• http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751
• http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
• http://secunia.com/advisories/40026
• http://secunia.com/advisories/40034
• http://secunia.com/advisories/40144
• http://secunia.com/advisories/40545
• http://secunia.com/advisories/43026
• http://security.gentoo.org/glsa/glsa-201101-09.xml

Get alerted when CVE-2010-1297 or the next vulnerability affects your stack