CVE-2008-1834 swfdec_load_object.c in Swfdec before 0.6.4 does not properly restrict local file access from untrusted sandboxes, which allows remote attackers to read arbitrary files via a crafted Flash file.
MediumCVSS 4.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
swfdec_load_object.c in Swfdec before 0.6.4 does not properly restrict local file access from untrusted sandboxes, which allows remote attackers to read arbitrary files via a crafted Flash file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| swfdec | <= 0.6.2 | No fix listed |
| swfdec | = 0.4.0 | No fix listed |
| swfdec | = 0.4.1 | No fix listed |
| swfdec | = 0.4.2 | No fix listed |
| swfdec | = 0.4.3 | No fix listed |
| swfdec | = 0.4.4 | No fix listed |
| swfdec | = 0.4.5 | No fix listed |
| swfdec | = 0.5.0 | No fix listed |
| swfdec | = 0.5.1 | No fix listed |
| swfdec | = 0.5.2 | No fix listed |
| swfdec | = 0.5.3 | No fix listed |
| swfdec | = 0.5.4 | No fix listed |
| swfdec | = 0.5.5 | No fix listed |
| swfdec | = 0.5.90 | No fix listed |
| swfdec | = 0.6.0 | No fix listed |
References
- gitweb.freedesktop.org
- [Swfdec] 20080409 Swfdec 0.6.4 released mailing-list patch
- 29915 third-party-advisory vendor-advisory
- 28881 vdb-entry
- swfdec-swfdecloadobject-info-disclosure(41887) vdb-entry