CVE-2011-2123

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Integer overflow in the Shockwave 3D Asset x32 component in Adobe Shockwave Player before 11.6.0.626 allows remote attackers to execute arbitrary code via a crafted subrecord in a DEMX chunk, which triggers a heap-based buffer overflow.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-189

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=922
http://www.adobe.com/support/security/bulletins/apsb11-17.htmlPatch, Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA11-166A.htmlUS Government Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=922
http://www.adobe.com/support/security/bulletins/apsb11-17.htmlPatch, Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA11-166A.htmlUS Government Resource

Timeline

Published: Jun 16, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-21249.3Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns CVE-2011-21259.3Buffer overflow in Dirapix.dll in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vector CVE-2011-21269.3Buffer overflow in Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code via unspecified vectors.CVE-2011-21279.3Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns CVE-2011-21289.3Adobe Shockwave Player before 11.6.0.626 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via uns CVE-2011-213010.0Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe CVE-2011-21319.3Adobe Photoshop 12.0 in Creative Suite 5 (CS5) and 12.1 in Creative Suite 5.1 (CS5.1) allows remote attackers to execute arbitrary code or c CVE-2011-21325.0Adobe Flash Media Server (FMS) before 3.5.7, and 4.x before 4.0.3, allows attackers to cause a denial of service (memory corruption) via uns CVE-2011-21334.3Cross-site scripting (XSS) vulnerability in Adobe RoboHelp 8 and 9 before 9.0.1.262, and RoboHelp Server 8 and 9, allows remote attackers to CVE-2011-213410.0Buffer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe CVE-2011-213510.0Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 o CVE-2011-213610.0Integer overflow in Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adob