CVE-2005-3591

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Macromedia Flash plugin (1) Flash.ocx 7.0.19.0 (Windows) and earlier and (2) libflashplayer.so before 7.0.25.0 (Unix) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via parameters to the ActionDefineFunction ActionScript call in a SWF file, which causes an improper memory access condition, a different vulnerability than CVE-2005-2628.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=113140426614670&w=2
http://secunia.com/advisories/17430/Patch, Vendor Advisory
http://secunia.com/advisories/17437/Vendor Advisory
http://secunia.com/advisories/17481/Vendor Advisory
http://secunia.com/advisories/17626/Vendor Advisory
http://secunia.com/advisories/17738/Vendor Advisory
http://securityreason.com/securityalert/149
http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.htmlVendor Advisory
http://www.microsoft.com/technet/security/advisory/910550.mspxVendor Advisory
http://www.sec-consult.com/226.htmlExploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/15334Exploit, Patch
http://www.vupen.com/english/advisories/2005/2317Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/23022
http://marc.info/?l=bugtraq&m=113140426614670&w=2
http://secunia.com/advisories/17430/Patch, Vendor Advisory
http://secunia.com/advisories/17437/Vendor Advisory
http://secunia.com/advisories/17481/Vendor Advisory
http://secunia.com/advisories/17626/Vendor Advisory
http://secunia.com/advisories/17738/Vendor Advisory
http://securityreason.com/securityalert/149
http://www.macromedia.com/devnet/security/security_zone/mpsb05-07.htmlVendor Advisory
http://www.microsoft.com/technet/security/advisory/910550.mspxVendor Advisory
http://www.sec-consult.com/226.htmlExploit, Patch, Vendor Advisory
http://www.securityfocus.com/bid/15334Exploit, Patch
http://www.vupen.com/english/advisories/2005/2317Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/23022

Timeline

Published: Nov 16, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-35925.0index.php CuteNews 1.4.0 and earlier allows remote attackers to obtain the path of the installation path of the application by triggering an CVE-2005-35945.0game_score.php in e107 allows remote attackers to insert high scores via HTTP POST methods utilizing the $player_name, $player_score, and $g CVE-2005-359510.0By default Microsoft Windows XP Home Edition installs with a blank password for the Administrator account, which allows remote attackers to CVE-2005-35967.5SQL injection vulnerability in ASPKnowledgebase allows remote attackers to execute arbitrary SQL commands and bypass authentication via the CVE-2005-36187.6Cross-site request forgery (CSRF) vulnerability in the management interface for VMware ESX Server 2.0.x before 2.0.2 patch 1, 2.1.x before 2 CVE-2005-36196.8Cross-site scripting (XSS) vulnerability in the management interface for VMware ESX 2.5.x before 2.5.2 upgrade patch 2, 2.1.x before 2.1.2 u CVE-2005-36202.1The management interface for VMware ESX Server 2.0.x before 2.0.2 patch 1, 2.1.x before 2.1.3 patch 1, and 2.x before 2.5.3 patch 2 records CVE-2005-36215.0CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecifi CVE-2005-36225.0phpMyAdmin 2.7.0-beta1 and earlier allows remote attackers to obtain the full path of the server via direct requests to multiple scripts in CVE-2005-36235.0nfs2acl.c in the Linux kernel 2.6.14.4 does not check for MAY_SATTR privilege before setting access controls (ACL) on files on exported NFS CVE-2005-36245.0The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others all CVE-2005-362510.0Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial