CVE-2010-3636
published 2010-11-07CVE-2010-3636: Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle…
PriorityP338critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
5.26%
91.7th percentile
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | flash_player | <= 10.1.95.1 | — |
| adobe | flash_player | >= 10.0 < 10.1.102.64 | 10.1.102.64 |
| adobe | flash_player | >= 9.0 < 9.0.289.0 | 9.0.289.0 |
CVSS provenance
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r3hm-9frm-fwcf: Adobe Flash Player before 9
ghsa_unreviewed·2022-05-13
CVE-2010-3636 [HIGH] GHSA-r3hm-9frm-fwcf: Adobe Flash Player before 9
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.
Red Hat
flash-plugin: security bulletin APSB10-26
vendor_redhat·2010-11-04·CVSS 9.3
CVE-2010-3636 [CRITICAL] flash-plugin: security bulletin APSB10-26
flash-plugin: security bulletin APSB10-26
Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, does not properly handle unspecified encodings during the parsing of a cross-domain policy file, which allows remote web servers to bypass intended access restrictions via unknown vectors.
No detection rules found.
No public exploits indexed.
http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1http://jvn.jp/en/jp/JVN48425028/index.htmlhttp://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.htmlhttp://marc.info/?l=bugtraq&m=130331642631603&w=2http://secunia.com/advisories/42183http://secunia.com/advisories/42926http://secunia.com/advisories/43026http://security.gentoo.org/glsa/glsa-201101-09.xmlhttp://support.apple.com/kb/HT4435http://www.adobe.com/support/security/bulletins/apsb10-26.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0829.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0834.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0867.htmlhttp://www.securityfocus.com/bid/44691http://www.vupen.com/english/advisories/2010/2903http://www.vupen.com/english/advisories/2010/2906http://www.vupen.com/english/advisories/2010/2918http://www.vupen.com/english/advisories/2011/0173http://www.vupen.com/english/advisories/2011/0192https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_adobe_flash1http://jvn.jp/en/jp/JVN48425028/index.htmlhttp://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000054.htmlhttp://lists.apple.com/archives/security-announce/2010//Nov/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.htmlhttp://marc.info/?l=bugtraq&m=130331642631603&w=2http://secunia.com/advisories/42183http://secunia.com/advisories/42926http://secunia.com/advisories/43026http://security.gentoo.org/glsa/glsa-201101-09.xmlhttp://support.apple.com/kb/HT4435http://www.adobe.com/support/security/bulletins/apsb10-26.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0829.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0834.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0867.htmlhttp://www.securityfocus.com/bid/44691http://www.vupen.com/english/advisories/2010/2903http://www.vupen.com/english/advisories/2010/2906http://www.vupen.com/english/advisories/2010/2918http://www.vupen.com/english/advisories/2011/0173http://www.vupen.com/english/advisories/2011/0192https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12142https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15913
2010-11-07
Published