Which products and versions are affected by CVE-2010-3639?

Affected: Flash Player (Adobe); flash-plugin (redhat). The full list is in the CVE brief.

Is CVE-2010-3639 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2010-3639 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2010-3639?

A public exploit is reported by tracking sources, but no code link is listed yet.

Is there a fix for CVE-2010-3639?

Fixed versions are available, including Flash Player 9.0.289.0, flash-plugin 0:10.1.102.64-1.el5, flash-plugin 0:10.1.102.64-1.el6.

How urgently should CVE-2010-3639 be patched?

Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Request A Demo

WatchlistCritical

CVE-2010-3639Flash Player Vulnerability

flash-plugin: security bulletin APSB10-26

Published Nov 4, 2010 · Updated Aug 7, 2024

Key Facts

Patch immediately

CVE-2010-3639 is a critical-severity vulnerability (CVSS 9.3 v2) affecting Flash Player (Adobe), flash-plugin (redhat).
It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
EPSS estimates a 22% probability of exploitation in the next 30 days.
Fixed versions are available, including Flash Player 9.0.289.0, flash-plugin 0:10.1.102.64-1.el5, flash-plugin 0:10.1.102.64-1.el6.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Scores

CVSS v2

9.3

AV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS (30-day exploit likelihood)

22%

Higher than 97.6% of all scored CVEs

Exploit maturity

Proof of concept

ATLAS score

42/100

Publication score, see How it works

Exploitation Verdict

KEV listed

Not listed

Federal due date

None

No federal due date

Ransomware use

Not reported

Attributed actors

None named

Exploit & Defence Guidance

Exploit maturity

Proof of concept

Public exploit code

Proof-of-concept links

In-the-wild evidence

Reports of active use

Advisories And Exploit References

Description

Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.

Affected Products

4 affected entries in total

Product	Affected versions	Fixed in
Flash PlayerAdobe	See advisory	9.0.289.0
flash-pluginredhat	See advisory	0:9.0.289.0-1.el4

Patched Releases

Flash Player

9.0.289.0

flash-plugin

0:10.1.102.64-1.el5, 0:10.1.102.64-1.el6, 0:9.0.289.0-1.el4

Timeline

Publicly disclosed
Nov 4, 2010
Last updated
Aug 7, 2024

References

15 more references in the full CVE brief

FAQ

Common Questions.

Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors.
Affected: Flash Player (Adobe); flash-plugin (redhat). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including Flash Player 9.0.289.0, flash-plugin 0:10.1.102.64-1.el5, flash-plugin 0:10.1.102.64-1.el6.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.

Is CVE-2010-3639 On Your Attack Surface?

Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.