CVE-2008-4401 ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileRef...
HighCVSS 10.0
EPSS 9.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe flash player | <= 9.0.124.0 | No fix listed |
| Adobe flash player | = 7.0 | No fix listed |
| Adobe flash player | = 7.0.1 | No fix listed |
| Adobe flash player | = 7.0.25 | No fix listed |
| Adobe flash player | = 7.0.63 | No fix listed |
| Adobe flash player | = 7.0.69.0 | No fix listed |
| Adobe flash player | = 7.0.70.0 | No fix listed |
| Adobe flash player | = 7.0_r67 | No fix listed |
| Adobe flash player | = 7.1 | No fix listed |
| Adobe flash player | = 7.1.1 | No fix listed |
| Adobe flash player | = 7.2 | No fix listed |
| Adobe flash player | = 8.0 | No fix listed |
| Adobe flash player | = 8.0.24.0 | No fix listed |
| Adobe flash player | = 8.0.34.0 | No fix listed |
| Adobe flash player | = 8.0.35.0 | No fix listed |
| Adobe flash player | = 8.0.39.0 | No fix listed |
| Adobe flash player | = 9.0 | No fix listed |
| Adobe flash player | = 9.0.112.0 | No fix listed |
| Adobe flash player | = 9.0.114.0 | No fix listed |
| Adobe flash player | = 9.0.115.0 | No fix listed |
References
- SUSE-SR:2008:025 vendor-advisory
- 32270 patch third-party-advisory vendor-advisory
- 32448 third-party-advisory
- 32702 third-party-advisory
- 32759 third-party-advisory
- 33390 third-party-advisory
- 34226 third-party-advisory
- GLSA-200903-23 vendor-advisory
- 1021061 vdb-entry
- 248586 vendor-advisory
- support.avaya.com
- support.avaya.com
- www.adobe.com
- www.adobe.com patch vendor-advisory
- RHSA-2008:0945 vendor-advisory
- RHSA-2008:0980 vendor-advisory
- ADV-2008-2838 vdb-entry
- adobe-flash-filereference-file-upload(45913) vdb-entry