CVE-2008-5362

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/33390Third Party Advisory
http://secunia.com/advisories/34226Third Party Advisory
http://security.gentoo.org/glsa/glsa-200903-23.xmlThird Party Advisory
http://securityreason.com/securityalert/4692Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1Broken Link
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htmThird Party Advisory
http://www.adobe.com/support/security/bulletins/apsb08-22.htmlPatch, Vendor Advisory
http://www.isecpartners.com/advisories/2008-01-flash.txtThird Party Advisory
http://www.securityfocus.com/archive/1/498561/100/0/threadedThird Party Advisory, VDB Entry
http://secunia.com/advisories/33390Third Party Advisory
http://secunia.com/advisories/34226Third Party Advisory
http://security.gentoo.org/glsa/glsa-200903-23.xmlThird Party Advisory
http://securityreason.com/securityalert/4692Third Party Advisory
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1Broken Link
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htmThird Party Advisory
http://www.adobe.com/support/security/bulletins/apsb08-22.htmlPatch, Vendor Advisory
http://www.isecpartners.com/advisories/2008-01-flash.txtThird Party Advisory
http://www.securityfocus.com/archive/1/498561/100/0/threadedThird Party Advisory, VDB Entry

Timeline

Published: Dec 8, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-53634.3The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not CVE-2008-53649.3Stack-based buffer overflow in the getPlus ActiveX control in gp.ocx 1.2.2.50 in NOS Microsystems getPlus Download Manager, as used for the CVE-2008-53657.5SQL injection vulnerability in VoteHistory.asp in ActiveWebSoftwares ActiveVotes 2.2 allows remote attackers to execute arbitrary SQL comman CVE-2008-53666.9The postinst script in ppp 2.4.4rel on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp CVE-2008-53676.9ip-up in ppp-udeb 2.4.4rel on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on the /tmp/resolv.conf.CVE-2008-53686.9muttprint in muttprint 0.72d allows local users to overwrite arbitrary files via a symlink attack on the /tmp/muttprint.log temporary file.CVE-2008-53696.9noip2 in noip2 2.1.7 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/noip2 temporary file.CVE-2008-53706.9pvpgn-support-installer in pvpgn 1.8.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/pvpgn-support-1.0.ta CVE-2008-53716.9screenie in screenie 1.30.0 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.screenie.##### temporary file.CVE-2008-53726.9sdm-login in sdm-terminal 0.4.0b allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sdm.autologin.once tempora CVE-2008-53736.9mtx-changer.Adic-Scalar-24 in bacula-common 2.4.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/mtx.##### t CVE-2008-53746.9bash-doc 3.2 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/cb#####.? temporary file, related to the (1) ali