Vulnerability Details : CVE-2008-5362
The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.
Vulnerability category: Input validation
Products affected by CVE-2008-5362
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-5362
0.54%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-5362
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2008-5362
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-5362
-
http://www.adobe.com/support/security/bulletins/apsb08-22.html
Patch;Vendor Advisory
-
http://www.isecpartners.com/advisories/2008-01-flash.txt
Third Party Advisory
-
http://security.gentoo.org/glsa/glsa-200903-23.xml
Adobe Flash Player: Multiple vulnerabilities (GLSA 200903-23) — Gentoo securityThird Party Advisory
-
http://securityreason.com/securityalert/4692
Third Party Advisory
-
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm
Third Party Advisory
-
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1
Broken Link
-
http://www.securityfocus.com/archive/1/498561/100/0/threaded
Third Party Advisory;VDB Entry
Jump to