CVE-2008-5361 — Adobe AIR vulnerability

CWE-3995 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
3.1%
top 13.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Adobe AIRAdobe Flash Player
Timeline
PublishedDec 8
Latest updateMay 14

Description

The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when performing (1) DefineConstantPool, (2) ActionJump, (3) ActionPush, (4) ActionTry, and unspecified other actions, which allows remote attackers to read sensitive data from process memory via a crafted PDF file.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDadobe/flash_player9.0.16.0 — 9.0.151.0+1
▶NVDadobe/air< 1.5

Patches

Patch: www.adobe.com ↗Patch: www.adobe.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7p7w-xh5j-rhf6: The ActionScript 2 virtual machine in Adobe Flash Player 10↗2022-05-14
▶
CVEList
CVE-2008-5361: The ActionScript 2 virtual machine in Adobe Flash Player 10↗2008-12-08
▶

📋Vendor Advisories

1
Red Hat
security flaw↗2008-11-17
▶

💬Community

1
Bugzilla
CVE-2008-5361 security flaw↗2018-08-16
▶
CVE-2008-5361 — Adobe AIR vulnerability | cvebase