Vulnerabilities > CVE-2008-5361 - Resource Management Errors vulnerability in Adobe AIR and Flash Player

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
adobe
CWE-399
nessus
NVD
Published: 2008-12-08
Updated: 2024-11-21

Summary

The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when performing (1) DefineConstantPool, (2) ActionJump, (3) ActionPush, (4) ActionTry, and unspecified other actions, which allows remote attackers to read sensitive data from process memory via a crafted PDF file.

Vulnerable Configurations

Part Description Count
Application
Adobe
23

Common Weakness Enumeration (CWE)

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0945.NASL
    descriptionAn updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 18th November 2008] The erratum has been updated to include references to the additional CVE-named issues that were not public at the time of release. The security impact of the erratum has also been upgraded to Critical. No changes have been made to the packages. The flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in. A flaw was found in the way Adobe Flash Player wrote content to the clipboard. A malicious SWF file could populate the clipboard with a URL that could cause the user to mistakenly load an attacker-controlled URL. (CVE-2008-3873) A flaw was found which allowed Adobe Flash Player
    last seen2020-06-01
    modified2020-06-02
    plugin id63869
    published2013-01-24
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63869
    titleRHEL 5 : flash-plugin (RHSA-2008:0945)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2008-0980.NASL
    descriptionAn updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 3 and 4 Extras. This update has been rated as having critical security impact by the Red Hat Security Response Team. [Updated 18th November 2008] This erratum has been updated to include a reference to the additional CVE-named issue that was not public at the time of release. The security impact of the erratum has also been upgraded to Critical. No changes have been made to the packages. The flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in. A flaw was found in the way Adobe Flash Player wrote content to the clipboard. A malicious SWF (Shockwave Flash) file could populate the clipboard with a URL that could cause the user to accidentally or mistakenly load an attacker-controlled URL. (CVE-2008-3873) A flaw was found with Adobe
    last seen2020-06-01
    modified2020-06-02
    plugin id63870
    published2013-01-24
    reporterThis script is Copyright (C) 2013-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/63870
    titleRHEL 3 / 4 : flash-plugin (RHSA-2008:0980)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200903-23.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200903-23 (Adobe Flash Player: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Flash Player: The access scope of SystemsetClipboard() allows ActionScript programs to execute the method without user interaction (CVE-2008-3873). The access scope of FileReference.browse() and FileReference.download() allows ActionScript programs to execute the methods without user interaction (CVE-2008-4401). The Settings Manager controls can be disguised as normal graphical elements. This so-called
    last seen2020-06-01
    modified2020-06-02
    plugin id35904
    published2009-03-11
    reporterThis script is Copyright (C) 2009-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/35904
    titleGLSA-200903-23 : Adobe Flash Player: Multiple vulnerabilities

Redhat

rpms
  • flash-plugin-0:10.0.12.36-2.el5
  • flash-plugin-0:9.0.151.0-1.el3.with.oss
  • flash-plugin-0:9.0.151.0-1.el4

References