CVE-2008-4473: Buffer Overflow

Published Oct 17, 2008

Updated

Multiple heap-based buffer overflows in Adobe Flash CS3 Professional on Windows and Flash MX 2004 allow remote attackers to execute arbitrary code via an SWF file containing long control parameters.

Affected Software

3 affected components

Adobe Flash Player=mx_2004

Adobe Flash Player=cs3

Microsoft Windows

Event History

Oct 17, 2008

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

Which environments are identified as affected?

The affected products named are Adobe Flash CS3 Professional on Windows and Flash MX 2004. The software field also identifies Adobe Flash Player, but no version information is provided.

Does an attacker need local access or authentication to exploit this issue?

No. The vulnerability is rated as network-accessible with no authentication required, and the description states that remote attackers can exploit it.

What is required for exploitation?

An attacker needs to provide an SWF file containing long control parameters. Successful exploitation can result in arbitrary code execution.

CVE-2008-4473: Buffer Overflow

Affected Software

Event History

Frequently Asked Questions

Which environments are identified as affected?

Does an attacker need local access or authentication to exploit this issue?

What is required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which environments are identified as affected?

Does an attacker need local access or authentication to exploit this issue?

What is required for exploitation?