Unscored severity · published Dec 8, 2008
CVE-2008-5361
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when…
–
CVSS
3.8%
EPSS
No
On KEV
Description
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not verify a member element's size when performing (1) DefineConstantPool, (2) ActionJump, (3) ActionPush, (4) ActionTry, and unspecified other actions, which allows remote attackers to read sensitive data from process memory via a crafted PDF file.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.8% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Air · Adobe
before 1.5 · source: NVD
FP
Flash Player · Adobe
9.0.16.0 before 9.0.151.0; 10 before 10.0.12.36 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5361
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5361
Third Party Advisory
http://secunia.com/advisories/33390
Third Party Advisory
http://secunia.com/advisories/34226
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200903-23.xml
Third Party Advisory
http://securityreason.com/securityalert/4692
Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1
Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm
More from Air
8.8
CVE-2016-1010
Adobe Flash Player and AIR Integer Overflow Vulnerability
8.8
CVE-2015-8651
Adobe Flash Player Integer Overflow Vulnerability
8.8
CVE-2014-8439
Adobe Flash Player Dereferenced Pointer Vulnerability
8.8
CVE-2014-0502
Adobe Flash Player Double Free Vulnerablity
8.8
CVE-2011-0611
Adobe Flash Player Remote Code Execution Vulnerability