CVE-2008-5362: Input Validation
The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2008-5362?
CVE-2008-5362 is considered a critical vulnerability that can allow remote attackers to read sensitive data from memory.
How do I fix CVE-2008-5362?
To fix CVE-2008-5362, upgrade Adobe Flash Player to version 10.0.12.36 or later, or version 9.0.151.0 or later, and update Adobe AIR to version 1.5 or later.
What software is affected by CVE-2008-5362?
CVE-2008-5362 affects Adobe Flash Player versions prior to 10.0.12.36 and 9.0.151.0, as well as Adobe AIR versions before 1.5.
Can CVE-2008-5362 lead to data exposure?
Yes, CVE-2008-5362 can lead to unauthorized data exposure by allowing attackers to read sensitive information from process memory.
What should I do if I cannot update software due to CVE-2008-5362?
If unable to update due to CVE-2008-5362, consider restricting access to affected software or using alternative solutions to mitigate risk.