Vulnerability in Adobe Air
CVE-2008-5363
The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.037 (89.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.037 · newest: 0.037 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securityfocus.com/archive/1/498561/100/0/threaded (mailing-list, VDB Entry, Third Party Advisory)
- secunia.com/advisories/33390 (Third Party Advisory, third-party-advisory)
- www.isecpartners.com/advisories/2008-01-flash.txt (Third Party Advisory)
- support.avaya.com/elmodocs2/security/ASA-2009-020.htm (Third Party Advisory)
- www.adobe.com/support/security/bulletins/apsb08-22.html (Patch, Vendor Advisory)
- secunia.com/advisories/34226 (Third Party Advisory, third-party-advisory)
- securityreason.com/securityalert/4692 (Third Party Advisory, third-party-advisory)
- security.gentoo.org/glsa/glsa-200903-23.xml (vendor-advisory, Third Party Advisory)
- sunsolve.sun.com/search/document.do (vendor-advisory, Broken Link)
Frequently asked questions
- What is CVE-2008-5363?
- CVE-2008-5363 is a vulnerability in Adobe Air, classified under CWE-399. Published 2008-12-08.
- Is CVE-2008-5363 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.