Unscored severity · published Dec 8, 2008
CVE-2008-5363
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during…
–
CVSS
3.7%
EPSS
No
On KEV
Description
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Air · Adobe
before 1.5 · source: NVD
FP
Flash Player · Adobe
9.0.16.0 before 9.0.151.0; 10 before 10.0.12.36 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-5363
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-5363
Third Party Advisory
http://secunia.com/advisories/33390
Third Party Advisory
http://secunia.com/advisories/34226
Third Party Advisory
http://security.gentoo.org/glsa/glsa-200903-23.xml
Third Party Advisory
http://securityreason.com/securityalert/4692
Broken Link
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1
Third Party Advisory
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm
More from Air
8.8
CVE-2016-1010
Adobe Flash Player and AIR Integer Overflow Vulnerability
8.8
CVE-2015-8651
Adobe Flash Player Integer Overflow Vulnerability
8.8
CVE-2014-8439
Adobe Flash Player Dereferenced Pointer Vulnerability
8.8
CVE-2014-0502
Adobe Flash Player Double Free Vulnerablity
8.8
CVE-2011-0611
Adobe Flash Player Remote Code Execution Vulnerability