CVE-2008-5362 — Improper Input Validation in Adobe AIR

CWE-20 — Improper Input Validation5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
3.1%
top 13.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Adobe AIRAdobe Flash Player
Timeline
PublishedDec 8
Latest updateMay 14

Description

The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDadobe/flash_player9.0.16.0 — 9.0.151.0+1
▶NVDadobe/air< 1.5

Patches

Patch: www.adobe.com ↗Patch: www.adobe.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-7p67-pjvg-2587: The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10↗2022-05-14
▶
CVEList
CVE-2008-5362: The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10↗2008-12-08
▶

📋Vendor Advisories

1
Red Hat
security flaw↗2008-11-17
▶

💬Community

1
Bugzilla
CVE-2008-5362 security flaw↗2018-08-16
▶
CVE-2008-5362 — Improper Input Validation in Adobe AIR | cvebase