CVE-2010-3976
Summary
| CVE | CVE-2010-3976 |
|---|---|
| State | PUBLISHED |
| Assigner | adobe |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-10-19 21:00:10 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Untrusted search path vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Flash Player. |
Risk And Classification
Primary CVSS: v2.0 9.3 from [email protected]
AV:N/AC:M/Au:N/C:C/I:C/A:C
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:M/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Adobe | Flash Player | 10.0.0.584 | All | All | All |
| Application | Adobe | Flash Player | 10.0.12.10 | All | All | All |
| Application | Adobe | Flash Player | 10.0.12.36 | All | All | All |
| Application | Adobe | Flash Player | 10.0.15.3 | All | All | All |
| Application | Adobe | Flash Player | 10.0.22.87 | All | All | All |
| Application | Adobe | Flash Player | 10.0.32.18 | All | All | All |
| Application | Adobe | Flash Player | 10.0.42.34 | All | All | All |
| Application | Adobe | Flash Player | 10.0.45.2 | All | All | All |
| Application | Adobe | Flash Player | 10.1.52.14.1 | All | All | All |
| Application | Adobe | Flash Player | 10.1.52.15 | All | All | All |
| Application | Adobe | Flash Player | 10.1.53.64 | All | All | All |
| Application | Adobe | Flash Player | 10.1.82.76 | All | All | All |
| Application | Adobe | Flash Player | 10.1.85.3 | All | All | All |
| Application | Adobe | Flash Player | 10.1.92.8 | All | All | All |
| Application | Adobe | Flash Player | 10.1.95.1 | All | All | All |
| Application | Adobe | Flash Player | 10.1.95.2 | All | All | All |
| Application | Adobe | Flash Player | 9.0.112.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.114.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.115.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.124.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.125.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.151.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.152.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.155.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.159.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.16 | All | All | All |
| Application | Adobe | Flash Player | 9.0.18d60 | All | All | All |
| Application | Adobe | Flash Player | 9.0.20 | All | All | All |
| Application | Adobe | Flash Player | 9.0.20.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.246.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.260.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.262.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.28 | All | All | All |
| Application | Adobe | Flash Player | 9.0.28.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.31 | All | All | All |
| Application | Adobe | Flash Player | 9.0.31.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.45.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.47.0 | All | All | All |
| Application | Adobe | Flash Player | 9.0.48.0 | All | All | All |
| Application | Adobe | Flash Player | All | All | All | All |
| Application | Adobe | Flash Player | All | All | All | All |
| Operating System | Microsoft | Windows | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| About the security content of Mac OS X v10.6.5 and Security Update 2010-007 | af854a3a-2127-422b-91ae-364da2661108 | support.apple.com | Vendor Advisory |
| APPLE-SA-2010-11-10-1 Mac OS X v10.6.5 and Security Update 2010-007 | af854a3a-2127-422b-91ae-364da2661108 | lists.apple.com | Vendor Advisory |
| Adobe Flash Player DLL Loading Arbitrary Code Execution Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| [security-announce] SUSE Security Announcement: flash-player (SUSE-SA:20 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Gentoo Linux Documentation -- Adobe Flash Player: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| '[security bulletin] HPSBMA02663 SSRT100428 rev.1 - HP Systems Insight Manager (SIM) for HP-UX, Linux' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| www.acrossecurity.com/aspr/ASPR-2010-11-05-1-PUB.txt | af854a3a-2127-422b-91ae-364da2661108 | www.acrossecurity.com | |
| core.yehg.net/lab/pr0js/advisories/dll_hijacking/%5Bflash_player%5D_10.1.x_... | af854a3a-2127-422b-91ae-364da2661108 | core.yehg.net | |
| Gentoo update for adobe-flash - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Adobe Flash Player IE version 10.1.x Insecure DLL Hijacking Vulnerability (dwmapi.dll) | af854a3a-2127-422b-91ae-364da2661108 | www.derkeiler.com | Exploit |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Adobe - Security Bulletins: APSB10-26 - Security update available for Adobe Flash Player | af854a3a-2127-422b-91ae-364da2661108 | www.adobe.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.