CVE-2010-3976

Description

Untrusted search path vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Flash Player.

References

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6926

http://www.vupen.com/english/advisories/2011/0192

http://www.vupen.com/english/advisories/2010/2903

http://www.securityfocus.com/bid/44671

http://www.securityfocus.com/archive/1/514653/100/0/threaded

http://www.adobe.com/support/security/bulletins/apsb10-26.html

http://www.acrossecurity.com/aspr/ASPR-2010-11-05-1-PUB.txt

http://support.apple.com/kb/HT4435

http://security.gentoo.org/glsa/glsa-201101-09.xml

http://secunia.com/advisories/43026

http://marc.info/?l=bugtraq&m=130331642631603&w=2

http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html

http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html

http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/%5Bflash_player%5D_10.1.x_insecure_dll_hijacking_%28dwmapi.dll%29

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3