CVE-2003-1017

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Macromedia Flash Player before 7,0,19,0 stores a Flash data file in a predictable location that is accessible to web browsers such as Internet Explorer and Opera, which allows remote attackers to read restricted files via vulnerabilities in web browsers whose exploits rely on predictable names.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.macromedia.com/devnet/security/security_zone/mpsb03-08.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/8900Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/14013
http://www.macromedia.com/devnet/security/security_zone/mpsb03-08.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/8900Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/14013

Timeline

Published: Jan 5, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2003

CVE-2003-10187.2Format string vulnerability in enq command in AIX 4.3, 5.1, and 5.2 allows local users with rintq group privileges to gain privileges via un CVE-2003-10205.0The format_send_to_gui function in formats.c for irssi before 0.8.9 allows remote IRC users to cause a denial of service (crash).CVE-2003-10217.2The scosession program in OpenServer 5.0.6 and 5.0.7 allows local users to gain privileges via crafted strings on the commandline.CVE-2003-10227.5Directory traversal vulnerability in fsp before 2.81.b18 allows remote users to access files outside the FSP root directory.CVE-2003-10237.5Stack-based buffer overflow in vfs_s_resolve_symlink of vfs/direntry.c for Midnight Commander (mc) 4.6.0 and earlier, and possibly later ver CVE-2003-10247.2Unknown vulnerability in the ls-F builtin function in tcsh on Solaris 8 allows local users to create or delete files as other users, and gai CVE-2003-10254.3Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user CVE-2003-10269.3Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which CVE-2003-102710.0Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other window CVE-2003-10285.0The download function of Internet Explorer 6 SP1 allows remote attackers to obtain the cache directory name via an HTTP response with an inv CVE-2003-10295.0The L2TP protocol parser in tcpdump 3.8.1 and earlier allows remote attackers to cause a denial of service (infinite loop and memory consump CVE-2003-10307.5Buffer overflow in DameWare Mini Remote Control before 3.73 allows remote attackers to execute arbitrary code via a long pre-authentication