2398 matches found
CVE-2005-2628
Macromedia Flash 6 and 7 Flash.ocx allows remote attackers to execute arbitrary code via a SWF file with a modified frame type identifier that is used as an out-of-bounds array index to a function pointer...
CVE-2005-2628
CVE-2005-2628 concerns a buffer overflow in Macromedia Flash Player (Flash.ocx) for Flash 6/7. The issue arises from insufficient validation of SWF data, allowing a remote attacker to execute arbitrary code via a crafted SWF file. Red Hat’s RHSA-2005:835 notes the fix in updated Macromedia Flash ...
CVE-2002-1881
Macromedia Flash Player 4.0 r12 through 6.0.47.0 allows remote attackers to cause a denial of service web browser crash via malformed content in a Flash Shockwave .SWF file, as demonstrated by by ROT13 encoding the body of the file but not the headers...
CVE-2002-1881
CVE-2002-1881 affects Macromedia Flash Player 4.0 r12–6.0.47.0. A remote attacker can cause a browser crash (DoS) by feeding malformed Flash Shockwave (.SWF) content; ROT13-encoding the body while leaving headers unchanged demonstrates the issue. No further exploit details or remediation are prov...
Macromedia flash player -- swf file handling arbitrary code
A Secunia Advisory reports: A vulnerability has been reported in Macromedia Flash Player, which can be exploited by malicious people to compromise a user's system. The vulnerability is caused due to missing validation of the frame type identifier that is read from a SWF file. This value is used a...
Adobe Acrobat / Acrobat Reader local file access
SWF files embedded to document may access local files...
CVE-2002-1382
CVE-2002-1382 affects Macromedia Flash Player prior to 6.0.65.0. The vulnerability allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Flash (SWF) files; this is noted as a different issue from CAN-2002-0846. The available documents specify the affect...
CVE-2002-0846
The decoder for Macromedia Shockwave Flash allows remote attackers to execute arbitrary code via a malformed SWF header that contains more data than the specified length...
CVE-2002-0846
CVE-2002-0846 : The vulnerability concerns the decoder for Macromedia Shockwave Flash. A malformed SWF header containing more data than the specified length can enable remote code execution. The issue is described across multiple records (CVE/DV and NVD entries) as impacting the Shockwave Flash/S...
CVE-2002-1534
Macromedia Flash Player allows remote attackers to read arbitrary files via XML script in a .swf file that is hosted on a remote SMB share...
CVE-2002-1382
Macromedia Flash Player before 6.0.65.0 allows remote attackers to execute arbitrary code via certain malformed data headers in Shockwave Flash file format SWF files, a different issue than CAN-2002-0846...
CVE-2002-0477
Standalone Macromedia Flash Player 5.0 before 5,0,30,2 allows remote attackers to execute arbitrary programs via a .SWF file containing the "exec" FSCommand...
More SWF vulnerabilities?
Vulnerable systems: unpatched "standalone Flash players" Macromedia Shockwave Flash player versions before January 2002? Fix: "In response to the discovery of the virus, in January Macromedia released an update to its standalone Flash player that causes the player to ignore the "exec" action."...
Macromedia Flash plug-in contains buffer overflow
Overview Incorrectly formatted sound wave SWF files may cause a buffer overflow in the Macromedia Flash plug-in. Description If the length fields in an SWF file specify fewer data than are actually present in the file, processing the file may cause a buffer overflow in the Macromedia Flash plug-i...
CVE-2001-0166
Macromedia Shockwave Flash plugin version 8 and earlier allows remote attackers to cause a denial of service via malformed tag length specifiers in a SWF file...
CVE-2001-0166
CVE-2001-0166 affects the Macromedia Shockwave/Flash plug-in (version 8 and earlier). The vulnerability arises from malformed SWF tag length fields, triggering a buffer overflow on processing the file, which may crash the plug-in and cause a denial of service. CERT reports the issue as a crash (D...
