{"id": "CVE-2007-6246", "bulletinFamily": "NVD", "title": "CVE-2007-6246", "description": "Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges.", "published": "2007-12-19T20:46:00", "modified": "2017-09-28T21:29:52", "cvss": {"score": 4.4, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6246", "reporter": "NVD", "references": ["http://www.vupen.com/english/advisories/2007/4258", "http://www.us-cert.gov/cas/techalerts/TA07-355A.html", "https://exchange.xforce.ibmcloud.com/vulnerabilities/39136", "http://www.adobe.com/support/security/bulletins/apsb07-20.html", "http://www.securityfocus.com/bid/26965", "http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1", "http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html", "http://www.securityfocus.com/bid/26929", "http://securitytracker.com/id?1019116", "http://www.redhat.com/support/errata/RHSA-2007-1126.html", "http://www.vupen.com/english/advisories/2008/1724/references", "http://www.gentoo.org/security/en/glsa/glsa-200801-07.xml"], "cvelist": ["CVE-2007-6246"], "type": "cve", "lastseen": "2017-09-29T14:25:37", "history": [{"bulletin": {"assessment": {"href": "http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10519", "name": "oval:org.mitre.oval:def:10519", "system": "http://oval.mitre.org/XMLSchema/oval-definitions-5"}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:adobe:flash_player:9.0.48.0"], "cvelist": ["CVE-2007-6246"], "cvss": {"score": 4.4, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges.", "edition": 1, "enchantments": {}, "hash": "5a20d96fcedb52679bda404d0cafaa7e7780b9f2fc69e7e9e0ba5fa3a63ae1ae", "hashmap": [{"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "7b364453303e9ede52b585cafecbb1ab", "key": "title"}, {"hash": "b5663802287f7a831112ee8dec0147a2", "key": "cvss"}, {"hash": "64869033cee3d350b194baa856a66a2a", "key": "description"}, {"hash": "fc662acd3c0d609e49724c0afcedfd8b", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "46705dfef7dd08436347446e0d347151", "key": "cpe"}, {"hash": "597b97c0c10d80ad95680e14fe486e02", "key": "modified"}, {"hash": "ae2c53438a52d353019af469ec7da34a", "key": "published"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8533f962432bad332da79e044f57c5b3", "key": "assessment"}, {"hash": "f2aeb49c8da0b7aceba3ba253dbfd4af", "key": "references"}, {"hash": "8819232ab5585d225944943ace40e2b3", "key": "cvelist"}, {"hash": "96ed3ba285b30ceda727ab2a98de46ff", "key": "scanner"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6246", "id": "CVE-2007-6246", "lastseen": "2016-09-03T09:49:47", "modified": "2011-03-07T22:02:15", "objectVersion": "1.2", "published": "2007-12-19T20:46:00", "references": ["http://xforce.iss.net/xforce/xfdb/39136", "http://www.vupen.com/english/advisories/2007/4258", "http://www.us-cert.gov/cas/techalerts/TA07-355A.html", "http://www.adobe.com/support/security/bulletins/apsb07-20.html", "http://www.securityfocus.com/bid/26965", "http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1", "http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html", "http://www.securityfocus.com/bid/26929", "http://securitytracker.com/id?1019116", "http://www.redhat.com/support/errata/RHSA-2007-1126.html", "http://www.vupen.com/english/advisories/2008/1724/references", "http://www.gentoo.org/security/en/glsa/glsa-200801-07.xml"], "reporter": "NVD", "scanner": [{"href": "http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10519", "name": "oval:org.mitre.oval:def:10519", "system": "http://oval.mitre.org/XMLSchema/oval-definitions-5"}], "title": "CVE-2007-6246", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T09:49:47"}, {"bulletin": {"assessment": {"href": "http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10519", "name": "oval:org.mitre.oval:def:10519", "system": "http://oval.mitre.org/XMLSchema/oval-definitions-5"}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:adobe:flash_player:9.0.48.0"], "cvelist": ["CVE-2007-6246"], "cvss": {"score": 4.4, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0, when running on Linux, uses insecure permissions for memory, which might allow local users to gain privileges.", "edition": 2, "enchantments": {}, "hash": "ffc3f67f22157489721296900c045c3f2f078b737b5897d77633fcd24b867791", "hashmap": [{"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "7b364453303e9ede52b585cafecbb1ab", "key": "title"}, {"hash": "b5663802287f7a831112ee8dec0147a2", "key": "cvss"}, {"hash": "64869033cee3d350b194baa856a66a2a", "key": "description"}, {"hash": "fc662acd3c0d609e49724c0afcedfd8b", "key": "href"}, {"hash": "4896f217872a24207a530ecb06eb5cbf", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "46705dfef7dd08436347446e0d347151", "key": "cpe"}, {"hash": "ae2c53438a52d353019af469ec7da34a", "key": "published"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "8533f962432bad332da79e044f57c5b3", "key": "assessment"}, {"hash": "87c5b411cc2d22569cd418e71a0f5b6c", "key": "modified"}, {"hash": "8819232ab5585d225944943ace40e2b3", "key": "cvelist"}, {"hash": "96ed3ba285b30ceda727ab2a98de46ff", "key": "scanner"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-6246", "id": "CVE-2007-6246", "lastseen": "2017-08-08T11:24:22", "modified": "2017-08-07T21:29:02", "objectVersion": "1.3", "published": "2007-12-19T20:46:00", "references": ["http://www.vupen.com/english/advisories/2007/4258", "http://www.us-cert.gov/cas/techalerts/TA07-355A.html", "https://exchange.xforce.ibmcloud.com/vulnerabilities/39136", "http://www.adobe.com/support/security/bulletins/apsb07-20.html", "http://www.securityfocus.com/bid/26965", "http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1", "http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html", "http://www.securityfocus.com/bid/26929", "http://securitytracker.com/id?1019116", "http://www.redhat.com/support/errata/RHSA-2007-1126.html", "http://www.vupen.com/english/advisories/2008/1724/references", "http://www.gentoo.org/security/en/glsa/glsa-200801-07.xml"], "reporter": "NVD", "scanner": [{"href": "http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10519", "name": "oval:org.mitre.oval:def:10519", "system": "http://oval.mitre.org/XMLSchema/oval-definitions-5"}], "title": "CVE-2007-6246", "type": "cve", "viewCount": 0}, "differentElements": ["assessment", "modified"], "edition": 2, "lastseen": "2017-08-08T11:24:22"}], "edition": 3, "hashmap": [{"key": "assessment", "hash": "34cae0f22387d84276a2ef0c93941d53"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "46705dfef7dd08436347446e0d347151"}, {"key": "cvelist", "hash": "8819232ab5585d225944943ace40e2b3"}, {"key": "cvss", "hash": "b5663802287f7a831112ee8dec0147a2"}, {"key": "description", "hash": "64869033cee3d350b194baa856a66a2a"}, {"key": "href", "hash": "fc662acd3c0d609e49724c0afcedfd8b"}, {"key": "modified", "hash": "efd8bbfc177ba5b963a7a265b9714d5a"}, {"key": "published", "hash": "ae2c53438a52d353019af469ec7da34a"}, {"key": "references", "hash": "4896f217872a24207a530ecb06eb5cbf"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "96ed3ba285b30ceda727ab2a98de46ff"}, {"key": "title", "hash": "7b364453303e9ede52b585cafecbb1ab"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "4168959716cd39e4419782faca2d907934dac058bb36ecdea34f6614024528a3", "viewCount": 0, "enchantments": {"vulnersScore": 7.2}, "objectVersion": "1.3", "cpe": ["cpe:/a:adobe:flash_player:9.0.48.0"], "assessment": {"href": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10519", "name": "oval:org.mitre.oval:def:10519", "system": "http://oval.mitre.org/XMLSchema/oval-definitions-5"}, "scanner": [{"href": "http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10519", "name": "oval:org.mitre.oval:def:10519", "system": "http://oval.mitre.org/XMLSchema/oval-definitions-5"}]}

{"result": {"nessus": [{"id": "SUSE_FLASH-PLAYER-4856.NASL", "type": "nessus", "title": "SuSE 10 Security Update : flash-player (ZYPP Patch Number 4856)", "description": "This flash player update to version 9.0.115.0 fixes several security problems. In the worst case an attacker could potentially have flash-player execute arbitrary code via specially crafted files.\n(CVE-2007-4324 / CVE-2007-4768 / CVE-2007-5275 / CVE-2007-6242 / CVE-2007-6243 / CVE-2007-6244 / CVE-2007-6245 / CVE-2007-6246)\n\nNote: Since Adobe doesn't support browsers other than Firefox and Mozilla, this update doesn't work with browsers such as Konqueror.\nUpdates for konquerors are already in the works.", "published": "2007-12-24T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=29785", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2017-10-29T13:37:48"}, {"id": "FLASH_PLAYER_APSB07-20.NASL", "type": "nessus", "title": "Flash Player < 7.0.73.0 / 9.0.115.0 Multiple Vulnerabilities (APSB07-20)", "description": "According to its version number, the instance of Flash Player on the remote Windows host is affected by multiple issues, including several which could allow for arbitrary code execution by means of a malicious SWF file.", "published": "2007-12-19T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=29741", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2018-07-12T18:23:52"}, {"id": "FREEBSD_PKG_562CF6C4B9F111DCA302000102CC8983.NASL", "type": "nessus", "title": "FreeBSD : linux-flashplugin -- multiple vulnerabilities (562cf6c4-b9f1-11dc-a302-000102cc8983)", "description": "Adobe Security bulletin :\n\nCritical vulnerabilities have been identified in Adobe Flash Player that could allow an attacker who successfully exploits these potential vulnerabilities to take control of the affected system. A malicious SWF must be loaded in Flash Player by the user for an attacker to exploit these potential vulnerabilities. Users are recommended to update to the most current version of Flash Player available for their platform.", "published": "2008-01-04T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=29849", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-5476", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2017-10-29T13:32:51"}, {"id": "GENTOO_GLSA-200801-07.NASL", "type": "nessus", "title": "GLSA-200801-07 : Adobe Flash Player: Multiple vulnerabilities", "description": "The remote host is affected by the vulnerability described in GLSA-200801-07 (Adobe Flash Player: Multiple vulnerabilities)\n\n Flash contains a copy of PCRE which is vulnerable to a heap-based buffer overflow (GLSA 200711-30, CVE-2007-4768).\n Aaron Portnoy reported an unspecified vulnerability related to input validation (CVE-2007-6242).\n Jesse Michael and Thomas Biege reported that Flash does not correctly set memory permissions (CVE-2007-6246).\n Dan Boneh, Adam Barth, Andrew Bortz, Collin Jackson, and Weidong Shao reported that Flash does not pin DNS hostnames to a single IP addresses, allowing for DNS rebinding attacks (CVE-2007-5275).\n David Neu reported an error withing the implementation of the Socket and XMLSocket ActionScript 3 classes (CVE-2007-4324).\n Toshiharu Sugiyama reported that Flash does not sufficiently restrict the interpretation and usage of cross-domain policy files, allowing for easier cross-site scripting attacks (CVE-2007-6243).\n Rich Cannings reported a cross-site scripting vulnerability in the way the 'asfunction:' protocol was handled (CVE-2007-6244).\n Toshiharu Sugiyama discovered that Flash allows remote attackers to modify HTTP headers for client requests and conduct HTTP Request Splitting attacks (CVE-2007-6245).\n Impact :\n\n A remote attacker could entice a user to open a specially crafted file (usually in a web browser), possibly leading to the execution of arbitrary code with the privileges of the user running the Adobe Flash Player. The attacker could also cause a user's machine to establish TCP sessions with arbitrary hosts, bypass the Security Sandbox Model, obtain sensitive information, port scan arbitrary hosts, or conduct cross-site-scripting attacks.\n Workaround :\n\n There is no known workaround at this time.", "published": "2008-01-21T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=30031", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2018-07-12T18:26:07"}, {"id": "SUSE_FLASH-PLAYER-4855.NASL", "type": "nessus", "title": "openSUSE 10 Security Update : flash-player (flash-player-4855)", "description": "This flash player update to version 9.0.115.0 fixes several security problems. In the worst case an attacker could potentially have flash-player execute arbitrary code via specially crafted files.\n(CVE-2007-4324, CVE-2007-4768, CVE-2007-5275, CVE-2007-6242, CVE-2007-6243, CVE-2007-6244, CVE-2007-6245, CVE-2007-6246)\n\nNote: Since Adobe doesn't support browsers other than Firefox and Mozilla, this update doesn't work with browsers such as Konqueror.\nUpdates for konquerors are already in the works.", "published": "2007-12-24T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=29784", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2017-10-29T13:40:38"}, {"id": "REDHAT-RHSA-2007-1126.NASL", "type": "nessus", "title": "RHEL 3 / 4 / 5 : flash-plugin (RHSA-2007:1126)", "description": "An updated Adobe Flash Player package that fixes a security issue is now available for Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary.\n\nThis update has been rated as having critical security impact by the Red Hat Security Response Team.\n\nThe flash-plugin package contains a Firefox-compatible Adobe Flash Player Web browser plug-in.\n\nSeveral input validation flaws were found in the way Flash Player displays certain content. It may be possible to execute arbitrary code on a victim's machine, if the victim opens a malicious Adobe Flash file. (CVE-2007-4768, CVE-2007-6242, CVE-2007-6246)\n\nA flaw was found in the way Flash Player handled the asfunction:\nprotocol. Malformed SWF files could perform a cross-site scripting attack. (CVE-2007-6244)\n\nA flaw was found in the way Flash Player modified HTTP request headers. Malicious content could allow Flash Player to conduct a HTTP response splitting attack. (CVE-2007-6245)\n\nA flaw was found in the way Flash Player processes certain SWF content. A malicious SWF file could allow a remote attacker to conduct a port scanning attack from the client's machine. (CVE-2007-4324)\n\nA flaw was found in the way Flash Player establishes TCP sessions. A remote attacker could use Flash Player to conduct a DNS rebinding attack. (CVE-2007-5275)\n\nUsers of Adobe Flash Player are advised to upgrade to this updated package, which contains version 9.0.115.0 and resolves these issues.", "published": "2009-08-24T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=40711", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2017-10-29T13:45:40"}], "openvas": [{"id": "OPENVAS:60088", "type": "openvas", "title": "FreeBSD Ports: linux-flashplugin", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "published": "2008-09-04T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=60088", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-5476", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2017-07-02T21:10:20"}, {"id": "OPENVAS:850071", "type": "openvas", "title": "SuSE Update for flash-player SUSE-SA:2007:069", "description": "Check for the Version of flash-player", "published": "2009-01-28T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=850071", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2017-12-12T11:20:30"}, {"id": "OPENVAS:60219", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200801-07 (netscape-flash)", "description": "The remote host is missing updates announced in\nadvisory GLSA 200801-07.", "published": "2008-09-24T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://plugins.openvas.org/nasl.php?oid=60219", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2017-07-24T12:50:15"}], "redhat": [{"id": "RHSA-2007:1126", "type": "redhat", "title": "(RHSA-2007:1126) Critical: flash-plugin security update", "description": "The flash-plugin package contains a Firefox-compatible Adobe Flash Player\r\nWeb browser plug-in.\r\n\r\nSeveral input validation flaws were found in the way Flash Player displays\r\ncertain content. It may be possible to execute arbitrary code on a victim's\r\nmachine, if the victim opens a malicious Adobe Flash file. \r\n(CVE-2007-4768, CVE-2007-6242, CVE-2007-6246)\r\n\r\nA flaw was found in the way Flash Player handled the asfunction: protocol.\r\nMalformed SWF files could perform a cross-site scripting attack.\r\n(CVE-2007-6244)\r\n\r\nA flaw was found in the way Flash Player modified HTTP request headers.\r\nMalicious content could allow Flash Player to conduct a HTTP response\r\nsplitting attack. (CVE-2007-6245)\r\n\r\nA flaw was found in the way Flash Player processes certain SWF content. A\r\nmalicious SWF file could allow a remote attacker to conduct a port scanning\r\nattack from the client's machine. (CVE-2007-4324)\r\n\r\nA flaw was found in the way Flash Player establishes TCP sessions. A remote\r\nattacker could use Flash Player to conduct a DNS rebinding attack.\r\n(CVE-2007-5275) \r\n\r\nUsers of Adobe Flash Player are advised to upgrade to this updated package,\r\nwhich contains version 9.0.115.0 and resolves these issues.", "published": "2007-12-18T05:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://access.redhat.com/errata/RHSA-2007:1126", "cvelist": ["CVE-2007-4324", "CVE-2007-4768", "CVE-2007-5275", "CVE-2007-6242", "CVE-2007-6243", "CVE-2007-6244", "CVE-2007-6245", "CVE-2007-6246"], "lastseen": "2017-09-09T07:20:17"}], "suse": [{"id": "SUSE-SA:2007:069", "type": "suse", "title": "remote code execution in flash-player", "description": "A flash player update to version 9.0.115.0 fixes several security problems. In the worst case an attacker could potentially have flash-player execute arbitrary code via specially crafted flash content.\n#### Solution\nThere is no known workaround, please install the update packages.", "published": "2007-12-21T16:24:32", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2016-09-04T11:51:41"}], "freebsd": [{"id": "562CF6C4-B9F1-11DC-A302-000102CC8983", "type": "freebsd", "title": "linux-flashplugin -- multiple vulnerabilities", "description": "\nAdobe Security bulletin:\n\nCritical vulnerabilities have been identified in Adobe Flash\n\t Player that could allow an attacker who successfully exploits these\n\t potential vulnerabilities to take control of the affected system. A\n\t malicious SWF must be loaded in Flash Player by the user for an\n\t attacker to exploit these potential vulnerabilities. Users are\n\t recommended to update to the most current version of Flash Player\n\t available for their platform.\n\n", "published": "2007-12-18T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vuxml.freebsd.org/freebsd/562cf6c4-b9f1-11dc-a302-000102cc8983.html", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-5476", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2016-09-26T17:24:58"}], "gentoo": [{"id": "GLSA-200801-07", "type": "gentoo", "title": "Adobe Flash Player: Multiple vulnerabilities", "description": "### Background\n\nThe Adobe Flash Player is a renderer for the popular SWF file format, which is commonly used to provide interactive websites, digital experiences and mobile content. \n\n### Description\n\n * Flash contains a copy of PCRE which is vulnerable to a heap-based buffer overflow (GLSA 200711-30, CVE-2007-4768).\n * Aaron Portnoy reported an unspecified vulnerability related to input validation (CVE-2007-6242).\n * Jesse Michael and Thomas Biege reported that Flash does not correctly set memory permissions (CVE-2007-6246).\n * Dan Boneh, Adam Barth, Andrew Bortz, Collin Jackson, and Weidong Shao reported that Flash does not pin DNS hostnames to a single IP addresses, allowing for DNS rebinding attacks (CVE-2007-5275).\n * David Neu reported an error withing the implementation of the Socket and XMLSocket ActionScript 3 classes (CVE-2007-4324).\n * Toshiharu Sugiyama reported that Flash does not sufficiently restrict the interpretation and usage of cross-domain policy files, allowing for easier cross-site scripting attacks (CVE-2007-6243).\n * Rich Cannings reported a cross-site scripting vulnerability in the way the \"asfunction:\" protocol was handled (CVE-2007-6244).\n * Toshiharu Sugiyama discovered that Flash allows remote attackers to modify HTTP headers for client requests and conduct HTTP Request Splitting attacks (CVE-2007-6245).\n\n### Impact\n\nA remote attacker could entice a user to open a specially crafted file (usually in a web browser), possibly leading to the execution of arbitrary code with the privileges of the user running the Adobe Flash Player. The attacker could also cause a user's machine to establish TCP sessions with arbitrary hosts, bypass the Security Sandbox Model, obtain sensitive information, port scan arbitrary hosts, or conduct cross-site-scripting attacks. \n\n### Workaround\n\nThere is no known workaround at this time. \n\n### Resolution\n\nAll Adobe Flash Player users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=www-plugins/adobe-flash-9.0.115.0\"\n\nPlease be advised that unaffected packages of the Adobe Flash Player have known problems when used from within the Konqueror and Opera browsers.", "published": "2008-01-20T00:00:00", "cvss": {"score": 9.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://security.gentoo.org/glsa/200801-07", "cvelist": ["CVE-2007-4768", "CVE-2007-6243", "CVE-2007-4324", "CVE-2007-6246", "CVE-2007-6245", "CVE-2007-6242", "CVE-2007-6244", "CVE-2007-5275"], "lastseen": "2016-09-06T19:46:31"}]}}