Vulnerability Details : CVE-2008-5363
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.
Vulnerability category: Memory CorruptionDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2008-5363
Probability of exploitation activity in the next 30 days: 1.79%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 87 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2008-5363
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:N/A:P |
8.6
|
2.9
|
NIST |
CWE ids for CVE-2008-5363
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-5363
-
http://www.adobe.com/support/security/bulletins/apsb08-22.html
Patch;Vendor Advisory
-
http://www.isecpartners.com/advisories/2008-01-flash.txt
Third Party Advisory
-
http://security.gentoo.org/glsa/glsa-200903-23.xml
Third Party Advisory
-
http://securityreason.com/securityalert/4692
Third Party Advisory
-
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm
Third Party Advisory
-
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1
Broken Link
-
http://www.securityfocus.com/archive/1/498561/100/0/threaded
Third Party Advisory;VDB Entry
Products affected by CVE-2008-5363
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*