CVE-2007-2500: Buffer Overflow
server/parser/spritedefinition.cpp in GNU Gnash (aka GNU Flash Player) 0.7.2 allows remote attackers to execute arbitrary code via a large number of SHOWFRAME elements within a DEFINESPRITE element, which triggers memory corruption and enables the attacker to call free with an arbitrary address, probably resultant from a buffer overflow.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-2500?
CVE-2007-2500 is considered to have a high severity due to the potential for remote code execution.
How do I fix CVE-2007-2500?
To fix CVE-2007-2500, users should upgrade to a version of GNU Flash Player later than 0.7.2.
What types of attacks does CVE-2007-2500 facilitate?
CVE-2007-2500 facilitates remote code execution attacks due to memory corruption.
Which versions of GNU Flash Player are affected by CVE-2007-2500?
CVE-2007-2500 affects GNU Flash Player versions up to and including 0.7.2.
What kind of elements are involved in the exploitation of CVE-2007-2500?
Exploitation of CVE-2007-2500 involves a large number of SHOWFRAME elements within a DEFINESPRITE element.