CVE-2008-4546: Null Pointer Dereference

Published Oct 14, 2008

Updated

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF version numbers.

Affected Software

4 affected components

Adobe Flash Player=9.0.112.0

Adobe Flash Player=9.0.45.0

Adobe Flash Player=9.0.115.0

Adobe Flash Player=10.0.12.10

Event History

Oct 14, 2008

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-4546?

CVE-2008-4546 has a moderate severity rating due to its potential to cause denial of service.

How do I fix CVE-2008-4546?

To fix CVE-2008-4546, update Adobe Flash Player to version 9.0.277.0 or later, or 10.1.53.64 or later.

What versions are affected by CVE-2008-4546?

CVE-2008-4546 affects Adobe Flash Player versions prior to 9.0.277.0 and 10.x prior to 10.1.53.64.

What is the impact of CVE-2008-4546?

The impact of CVE-2008-4546 is a denial of service that can crash the browser due to a NULL pointer dereference.

Can CVE-2008-4546 be exploited remotely?

Yes, CVE-2008-4546 can be exploited remotely by web servers sending altered responses to HTTP requests.