CVE-2008-4546
MediumPublic exploitflash-plugin: crash caused by SWF files with different SWF versions obtained from the same URL
Published Oct 2, 2008 · Updated Aug 7, 2024
Key Facts
Patch immediately- CVE-2008-4546 is a medium-severity vulnerability (CVSS 4.3 v2) affecting Flash Player (Adobe), flash-plugin (redhat).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 66% probability of exploitation in the next 30 days.
- Fixed versions are available, including flash-plugin 0:10.1-2.el5, flash-plugin 0:9.0.277.0-1.el3.with.oss, flash-plugin 0:9.0.277.0-1.el4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
4.3
AV:N/AC:M/Au:N/C:N/I:N/A:P
EPSS (30-day exploit likelihood)
66%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2008-4546 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF version numbers.
Affected Products
7 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Flash PlayerAdobe | 10.0.12.10, 9.0.112.0, 9.0.115.0, 9.0.45.0 | n/a |
| flash-pluginredhat | See advisory | 0:9.0.277.0-1.el3.with.oss |
Patched Releases
flash-plugin
0:10.1-2.el5, 0:9.0.277.0-1.el3.with.oss, 0:9.0.277.0-1.el4
Timeline
Publicly disclosed
Oct 2, 2008
Last updated
Aug 7, 2024
Weakness Type
- CWE-399
References
- advisoryRHSA-2010:0464
- advisoryRHSA-2010:0470
- exploitExploitDB-32452
- exploithttp://www.mochimedia.com/~matthew/flashcrash/
- otherSSRT100179
FAQ
Common Questions.
Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provi…
Affected: Flash Player (Adobe) versions 10.0.12.10, 9.0.112.0, 9.0.115.0, 9.0.45.0; flash-plugin (redhat). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including flash-plugin 0:10.1-2.el5, flash-plugin 0:9.0.277.0-1.el3.with.oss, flash-plugin 0:9.0.277.0-1.el4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2008-4546 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo