Adobe Flash Player multiple security vulnerabilities updated since 20.12.2007
Published:		03.01.2008
Source:		FULL-DISCLOSURE
SecurityVulns ID:		8479
Type:		client
Level:		8/10
Description:		Heap buffer overflow on JPEG processing, universal crossite scripting, information leak.

Affected:		ADOBE : Flash Player 7.0
		ADOBE : Flash Player 8.0
		ADOBE : Flash Player 9.0
CVE:		CVE-2007-6244 (Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.)
		CVE-2007-6242 (Unspecified vulnerability in Adobe Flash Player 9.0.48.0 and earlier might allow remote attackers to execute arbitrary code via unknown vectors, related to "input validation errors.")

Original document		rich cannings, XSS Vulnerabilities in Common Shockwave Flash Files (03.01.2008)
		SECURITEAM, [EXPL] Socket Connection Timing Can Reveal Information About Network Configuration (Exploit) (24.12.2007)
		CERT, US-CERT Technical Cyber Security Alert TA07-355A -- Adobe Updates for Multiple Vulnerabilities (21.12.2007)
		Collin Jackson, [Full-disclosure] CVE-2007-6244: Adobe Flash Player ActiveX Control Universal Cross-Site Scripting Vulnerability (20.12.2007)
		3COM, [Full-disclosure] TPTI-07-21: Adobe Flash Player JPG Processing Heap Overflow Vulnerability (20.12.2007)

Discuss:

Read or add your comments to this news (0 comments)