CVSS: 4.3EPSS: 1%CPEs: 3EXPL: 0CVE-2008-5363
https://notcve.org/view.php?id=CVE-2008-5363
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file. La máquina virtual ActionScript v2 en Adobe Flash Player v10.x anteriores a v10.0.12.36 y en v9.x anteriores a v9.0.151.0, y en Adobe AIR anteriores a v1.5, no realizan validación de los caracteres de los elementos durante la recuperación de la estructura de datos del diccionario, permitiendo a atacantes remotos provocar una denegación de servicio (referencia a puntero NULO y parada de la aplicación) mediante un fichero PDF modificado. • http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://securityreason.com/securityalert/4692 http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm http://www.adobe.com/support/security/bulletins/apsb08-22.html http://www.isecpartners.com/advisories/2008-01-flash.txt http://www.securityfocus.com/archive/1/498561/100/0/threaded https: • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 61%CPEs: 2EXPL: 0CVE-2008-4824
https://notcve.org/view.php?id=CVE-2008-4824
Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors." Múltiples vulnerabilidades no especificadas en Adobe Flash Player 10.x versiones anteriores a v10.0.12.36 y 9.x versiones anteriores a v9.0.151.0 • http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html http://osvdb.org/49958 http://secunia.com/advisories/32702 http://secunia.com/advisories/32772 http://secunia.com/advisories/33179 http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.apple.com/kb/HT3338 http://support.avaya.com/elmodocs2/sec • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 23EXPL: 0CVE-2008-4821 – jar: protocol handler
https://notcve.org/view.php?id=CVE-2008-4821
Adobe Flash Player 9.0.124.0 and earlier, when a Mozilla browser is used, does not properly interpret jar: URLs, which allows attackers to obtain sensitive information via unknown vectors. Adobe Flash Player 9.0.124.0 y anteriores, cuando se usa un navegador de Mozilla, no interpreta adecuadamente URLs jar:, lo que permite a atacantes obtener información sensible mediante vectores desconocidos. • http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html http://secunia.com/advisories/32702 http://secunia.com/advisories/33179 http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.apple.com/kb/HT3338 http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm http://support.avaya.com/elmodocs2/securit • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 2%CPEs: 20EXPL: 0CVE-2008-4822 – Flash Player policy file interpretation flaw
https://notcve.org/view.php?id=CVE-2008-4822
Adobe Flash Player 9.0.124.0 and earlier does not properly interpret policy files, which allows remote attackers to bypass a non-root domain policy. Adobe Flash Player v9.0.124.0 y anteriores no interpretan de forma adecuada los ficheros de políticas, lo que permite a atacantes remotos saltarse la política de dominio “non-root” • http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html http://secunia.com/advisories/32702 http://secunia.com/advisories/33179 http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.apple.com/kb/HT3338 http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm http://support.avaya.com/elmodocs2/securit • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 5%CPEs: 20EXPL: 0CVE-2008-4819 – Flash Player DNS rebind attack
https://notcve.org/view.php?id=CVE-2008-4819
Unspecified vulnerability in Adobe Flash Player 9.0.124.0 and earlier makes it easier for remote attackers to conduct DNS rebinding attacks via unknown vectors. Vulnerabilidad no específica en Adobe Flash Player v9.0.124.0 y anteriores, facilitan a atacantes remotos conducir ataques de revinvulación DNS, mediante vectores desconocidos. • http://lists.apple.com/archives/security-announce//2008//Dec/msg00000.html http://secunia.com/advisories/32702 http://secunia.com/advisories/33179 http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.apple.com/kb/HT3338 http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm http://support.avaya.com/elmodocs2/securit •