CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2008-5361
https://notcve.org/view.php?id=CVE-2008-5361
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when performing (1) DefineConstantPool, (2) ActionJump, (3) ActionPush, (4) ActionTry, and unspecified other actions, which allows remote attackers to read sensitive data from process memory via a crafted PDF file. La máquina virtual ActionScript v2 en Adobe Flash Player v10.x anteriores a v10.0.12.36 y en v9.x anteriores a v9.0.151.0, y en Adobe AIR anteriores a v1.5, no verifica el tamaño de un elemento miembro cuando realiza las acciones (1) DefineConstantPool, (2) ActionJump, (3) ActionPush, (4) ActionTry, y otras acciones no especificadas, permitiendo a atacantes remotos leer información sensible del proceso en memoria mediante un fichero PDF modificado. • http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://securityreason.com/securityalert/4692 http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm http://www.adobe.com/support/security/bulletins/apsb08-22.html http://www.isecpartners.com/advisories/2008-01-flash.txt http://www.securityfocus.com/archive/1/498561/100/0/threaded https: • CWE-399: Resource Management Errors •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2008-5362
https://notcve.org/view.php?id=CVE-2008-5362
The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file. La acción "DefineConstantPool" en la máquina virtual ActionScript v2 en Adobe Flash Player v10.x anteriores a v10.0.12.36 y v9.x anteriores a v9.0.151.0, y en Adobe AIR anteriores a v1.5, acepta un valor de entrada no confiable en un "contador constante", permitiendo a atacantes remotos leer información sensible del proceso en memoria mediante un fichero PDF modificado. • http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://securityreason.com/securityalert/4692 http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm http://www.adobe.com/support/security/bulletins/apsb08-22.html http://www.isecpartners.com/advisories/2008-01-flash.txt http://www.securityfocus.com/archive/1/498561/100/0/threaded https: • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 1%CPEs: 3EXPL: 0CVE-2008-5363
https://notcve.org/view.php?id=CVE-2008-5363
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file. La máquina virtual ActionScript v2 en Adobe Flash Player v10.x anteriores a v10.0.12.36 y en v9.x anteriores a v9.0.151.0, y en Adobe AIR anteriores a v1.5, no realizan validación de los caracteres de los elementos durante la recuperación de la estructura de datos del diccionario, permitiendo a atacantes remotos provocar una denegación de servicio (referencia a puntero NULO y parada de la aplicación) mediante un fichero PDF modificado. • http://secunia.com/advisories/33390 http://secunia.com/advisories/34226 http://security.gentoo.org/glsa/glsa-200903-23.xml http://securityreason.com/securityalert/4692 http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1 http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm http://www.adobe.com/support/security/bulletins/apsb08-22.html http://www.isecpartners.com/advisories/2008-01-flash.txt http://www.securityfocus.com/archive/1/498561/100/0/threaded https: • CWE-399: Resource Management Errors •