Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and...

Vulnerability Description

Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.

References

• http://www.securitytracker.com/id?1020114
• http://secunia.com/advisories/29865
• http://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf
• http://secunia.com/advisories/30507
• http://www.securityfocus.com/bid/29386
• http://www.us-cert.gov/cas/techalerts/TA08-149A.html
• http://www.adobe.com/support/security/bulletins/apsb08-11.html
• http://www.vupen.com/english/advisories/2008/1724/references
• http://www.matasano.com/log/1032/this-new-vulnerability-dowds-inhuman-flash-exploit/
• http://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html
• http://www.redhat.com/support/errata/RHSA-2008-0221.html
• http://www.us-cert.gov/cas/techalerts/TA08-150A.html
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10379
• http://www.zerodayinitiative.com/advisories/ZDI-08-032/
• http://www.vupen.com/english/advisories/2008/1662/references
• http://www.osvdb.org/44282
• http://isc.sans.org/diary.html?storyid=4465
• http://secunia.com/advisories/30430
• http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html
• http://www.securityfocus.com/bid/28695
• http://secunia.com/advisories/29763
• http://www.securitytracker.com/id?1019811
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1
• http://www.gentoo.org/security/en/glsa/glsa-200804-21.xml
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37277
• http://www.vupen.com/english/advisories/2008/1697
• http://www.kb.cert.org/vuls/id/159523
• http://www.us-cert.gov/cas/techalerts/TA08-100A.html
• http://www.kb.cert.org/vuls/id/395473
• http://www.iss.net/threats/289.html
• http://secunia.com/advisories/30404