9.3
CVSSv2

CVE-2007-0071

Published: 09/04/2008 Updated: 30/10/2018
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
VMScore: 828
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Integer overflow in Adobe Flash Player 9.0.115.0 and previous versions, and 8.0.39.0 and previous versions, allows remote malicious users to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

adobe flash player

Vendor Advisories

Debian Bug report logs - #459071 CVE-2007-6637: Multiple cross-site scripting (XSS) vulnerabilities Package: flashplugin-nonfree; Maintainer for flashplugin-nonfree is Bart Martens <bartm@debianorg>; Source for flashplugin-nonfree is src:flashplugin-nonfree (PTS, buildd, popcon) Reported by: Steffen Joeris <steffenjoeri ...

Recent Articles

Monthly Malware Statistics: October 2009
Securelist • Eugene Aseev • 05 Nov 2009

Kaspersky Lab presents its monthly malware statistics for October. From this month onwards, the data used is gathered from all products which use the Kaspersky Security Network (KSN), i.e. products from both the 2009 and 2010 lines. As a result, the Top Twenties have changed somewhat, and the figures in both ratings this month are significantly higher, due to an increased numbers of users participating in KSN. The first Top Twenty lists malicious programs, adware and potentially unwanted program...

References

CWE-189http://www.adobe.com/support/security/bulletins/apsb08-11.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0221.htmlhttp://www.us-cert.gov/cas/techalerts/TA08-100A.htmlhttp://www.securitytracker.com/id?1019811http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.htmlhttp://secunia.com/advisories/29763http://www.iss.net/threats/289.htmlhttp://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdfhttp://www.matasano.com/log/1032/this-new-vulnerability-dowds-inhuman-flash-exploit/http://www.gentoo.org/security/en/glsa/glsa-200804-21.xmlhttp://www.osvdb.org/44282http://www.kb.cert.org/vuls/id/159523http://www.securityfocus.com/bid/28695http://secunia.com/advisories/29865http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.htmlhttp://isc.sans.org/diary.html?storyid=4465http://lists.apple.com/archives/security-announce/2008//May/msg00001.htmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1http://www.us-cert.gov/cas/techalerts/TA08-150A.htmlhttp://www.us-cert.gov/cas/techalerts/TA08-149A.htmlhttp://www.kb.cert.org/vuls/id/395473http://www.securityfocus.com/bid/29386http://www.securitytracker.com/id?1020114http://secunia.com/advisories/30404http://secunia.com/advisories/30430http://secunia.com/advisories/30507http://www.zerodayinitiative.com/advisories/ZDI-08-032/http://www.vupen.com/english/advisories/2008/1697http://www.vupen.com/english/advisories/2008/1662/referenceshttp://www.vupen.com/english/advisories/2008/1724/referenceshttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10379https://exchange.xforce.ibmcloud.com/vulnerabilities/37277https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=459071https://nvd.nist.govhttps://www.kb.cert.org/vuls/id/159523