Vulnerability CVE-2006-3311


Published: 2006-09-12   Modified: 2012-02-12

Description:
Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.

See advisories in our WLB2 database:
Topic
Author
Date
High
Adobe/Macromedia Flash Player Vulnerability
Stuart Pearson
18.09.2006

Type:

CWE-Other

Vendor: Adobe
Product: Flash player 
Version:
mx_2004
8.0.24.0
8
Product: Flex sdk 
Version: 1.5;

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.1/10
6.4/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html
http://security.gentoo.org/glsa/glsa-200610-02.xml
http://securityreason.com/securityalert/1546
http://securitytracker.com/id?1016829
http://www.adobe.com/support/security/bulletins/apsb06-11.html
http://www.computerterrorism.com/research/ct12-09-2006.htm
http://www.kb.cert.org/vuls/id/451380
http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html
http://www.redhat.com/support/errata/RHSA-2006-0674.html
http://www.securityfocus.com/archive/1/445825/100/0/threaded
http://www.securityfocus.com/bid/19980
http://www.us-cert.gov/cas/techalerts/TA06-275A.html
http://www.us-cert.gov/cas/techalerts/TA06-318A.html
http://www.vupen.com/english/advisories/2006/3573
http://www.vupen.com/english/advisories/2006/3577
http://www.vupen.com/english/advisories/2006/3852
http://www.vupen.com/english/advisories/2006/4507
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069
https://exchange.xforce.ibmcloud.com/vulnerabilities/28886
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394

Related CVE
CVE-2019-7963
Adobe Bridge CC version 9.0.2 and earlier versions have an out of bound read vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7956
Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Privilege Escalation in the context of the current user.
CVE-2019-7955
Adobe Experience Manager version 6.4 and ealier have a Reflected Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
CVE-2019-7953
Adobe Experience Manager version 6.4 and ealier have a Cross-Site Request Forgery vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.
CVE-2019-7941
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Information Exposure Through an Error Message vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7850
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
CVE-2019-7848
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Inadequate access control vulnerability. Successful exploitation could lead to Information Disclosure in the context of the current user.
CVE-2019-7847
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have an Improper Restriction of XML External Entity Reference ('XXE') vulnerability. Successful exploitation could lead to Arbitrary read access to the file system in the context of the...

Copyright 2019, cxsecurity.com

 

Back to Top