The table below lists the vulnerabilities addressed by Adobe on May 11, 2010.

Adobe Vulnerability Identifier	Adobe Bulletin Description	Severity	Affected Software	CVE ID
APSB10-11	Vulnerabilities that could lead to cross-site scripting and information disclosure.	Important	ColdFusion 8.0, 8.0.1, 9.0 and earlier versions	CVE-2009-3467 CVE-2010-1293 CVE-2010-1294
APSB10-12	Vulnerabilities being exploited to run malicious code on the affected system.	Critical	Shockwave Player 11.5.6.606 and earlier versions	CVE-2010-0127 CVE-2010-0128 CVE-2010-0129 CVE-2010-0130 CVE-2010-0986 CVE-2010-0987 CVE-2010-1280 CVE-2010-1281 CVE-2010-1282 CVE-2010-1283 CVE-2010-1284 CVE-2010-1286 CVE-2010-1287 CVE-2010-1288 CVE-2010-1289 CVE-2010-1290 CVE-2010-1291 CVE-2010-1292

Threat Remediation

Fortinet provides coverage on Adobe vulnerabilities in May 11, 2010.

CVE Number	Signature Name
CVE-2010-1293	Adobe.ColdFusion.logintowizard.cfm.XSS
CVE-2010-0127	Adobe.Shockwave.Player.Dir.File.Boundary.Error
CVE-2010-0128	Adobe.Shockwave.Player.Dir.File.Signedness.Error
CVE-2010-0129	Adobe.Shockwave.Player.Dir.File.Integer.Overflow
CVE-2010-0130	Adobe.Shockwave.Player.Dir.File.Memory.Corruption
CVE-2010-0986	Adobe.Shockware.Player.Parsing.Dir.File.Memory.Corruption
CVE-2010-0987	Adobe.Shockware.Player.Parsing.Dir.File.Buffer.Overflow
CVE-2010-1280	Adobe.Shockwave.Player.Dir.Invalid.Length.Code.Execution [Previous Name: FG-VD-10-013-Adobe]
CVE-2010-1281	Adobe.Shockwave.Player.Offset.Underflow.Memory.Corruption
CVE-2010-1282	Adobe.Shockwave.Player.Dir.File.ATOM.Size.DoS
CVE-2010-1283	Adobe.Shockwave.Player.3D.Parsing.Memory.Corruption
CVE-2010-1284	Adobe.Shockwave.Player.Dir.Invalid.Value.Code.Execution
CVE-2010-1286	Adobe.Shockwave.Player.Dir.File.DEMX.Tag.Memory.Corruption [Previous Name: FG-VD-10-004-Adobe]
CVE-2010-1287	Adobe.Shockwave.Player.Dir.File.Length.Field.Memory.Corruption [Previous Name: FG-VD-10-006-Adobe]
CVE-2010-1288	Adobe.Shockwave.Player.Dir.File.Parsing.Heap.Exhaustion [Previous Name: FG-VD-10-007-Adobe]
CVE-2010-1289	Adobe.Shockwave.Player.Dir.File.Handling.Memory.Corruption [Previous Name: FG-VD-10-008-Adobe]
CVE-2010-1290	Adobe.Shockwave.Player.IML32.Dll.Memory.Corruption [Previous Name: FG-VD-10-011-Adobe]
CVE-2010-1291	Adobe.Shockwave.Player.Dir.File.Parsing.Access.Violation [Previous Name: FG-VD-10-009-Adobe]
CVE-2010-1292	Adobe.Shockwave.Player.Dir.Tag.Invalid.Value.Code.Execution

For more information on new and enhanced signatures, visit the IPS Service Update History. If you require more information, contact the FortiGuard Team using our Contact Us web page.

Document History

Revision Date	Version Number
Tuesday, May 11 2010	1	Initial Documentation.

Reference:

• Adobe Security Bulletin Summary for May 11, 2010:
  • http://www.adobe.com/support/security/bulletins/apsb10-11.html
  • http://www.adobe.com/support/security/bulletins/apsb10-12.html