Buffer overflow on JPEG parsing, integer overflow on ActionScript execution.
vulners.com/securityvulns/securityvulns:doc:22894
vulners.com/securityvulns/securityvulns:doc:22895
vulners.com/securityvulns/securityvulns:doc:22896