CVE-2008-5362

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.

La acción "DefineConstantPool" en la máquina virtual ActionScript v2 en Adobe Flash Player v10.x anteriores a v10.0.12.36 y v9.x anteriores a v9.0.151.0, y en Adobe AIR anteriores a v1.5, acepta un valor de entrada no confiable en un "contador constante", permitiendo a atacantes remotos leer información sensible del proceso en memoria mediante un fichero PDF modificado.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-12-07 CVE Reserved
2008-12-08 CVE Published
2023-04-27 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (11)

URL	Tag	Source
http://secunia.com/advisories/33390	Third Party Advisory
http://secunia.com/advisories/34226	Third Party Advisory
http://securityreason.com/securityalert/4692	Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm	Third Party Advisory
http://www.isecpartners.com/advisories/2008-01-flash.txt	Third Party Advisory
http://www.securityfocus.com/archive/1/498561/100/0/threaded	Mailing List

URL	Date	SRC

URL	Date	SRC
http://www.adobe.com/support/security/bulletins/apsb08-22.html	2018-11-08

URL	Date	SRC
http://security.gentoo.org/glsa/glsa-200903-23.xml	2018-11-08
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1	2018-11-08
https://access.redhat.com/security/cve/CVE-2008-5362	2008-11-12
https://bugzilla.redhat.com/show_bug.cgi?id=1618338	2008-11-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Adobe Search vendor "Adobe"		Air Search vendor "Adobe" for product "Air"				< 1.5 Search vendor "Adobe" for product "Air" and version " < 1.5"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				>= 9.0.16.0 < 9.0.151.0 Search vendor "Adobe" for product "Flash Player" and version " >= 9.0.16.0 < 9.0.151.0"		-		Affected
Adobe Search vendor "Adobe"		Flash Player Search vendor "Adobe" for product "Flash Player"				>= 10 < 10.0.12.36 Search vendor "Adobe" for product "Flash Player" and version " >= 10 < 10.0.12.36"		-		Affected