漏洞描述
Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
lists.apple.comhttp://lists.apple.com/archives/security-announce/2008//May/msg00001.html↗documents.iss.nethttp://documents.iss.net/whitepapers/IBM_X-Force_WP_final.pdf↗secunia.comhttp://secunia.com/advisories/30404↗www.securitytracker.comhttp://www.securitytracker.com/id?1019811↗www.kb.cert.orghttp://www.kb.cert.org/vuls/id/395473↗secunia.comhttp://secunia.com/advisories/29763↗secunia.comhttp://secunia.com/advisories/30507↗www.kb.cert.orghttp://www.kb.cert.org/vuls/id/159523↗www.osvdb.orghttp://www.osvdb.org/44282↗www.securitytracker.comhttp://www.securitytracker.com/id?1020114↗www.adobe.comhttp://www.adobe.com/support/security/bulletins/apsb08-11.html↗lists.opensuse.orghttp://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html↗www.gentoo.orghttp://www.gentoo.org/security/en/glsa/glsa-200804-21.xml↗exchange.xforce.ibmcloud.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/37277↗isc.sans.orghttp://isc.sans.org/diary.html?storyid=4465↗www.zerodayinitiative.comhttp://www.zerodayinitiative.com/advisories/ZDI-08-032/↗www.securityfocus.comhttp://www.securityfocus.com/bid/29386↗www.redhat.comhttp://www.redhat.com/support/errata/RHSA-2008-0221.html↗www.iss.nethttp://www.iss.net/threats/289.html↗sunsolve.sun.comhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1↗www.us-cert.govhttp://www.us-cert.gov/cas/techalerts/TA08-150A.html↗oval.cisecurity.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10379↗secunia.comhttp://secunia.com/advisories/30430↗www.us-cert.govhttp://www.us-cert.gov/cas/techalerts/TA08-100A.html↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/1697↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/1724/references↗blogs.adobe.comhttp://blogs.adobe.com/psirt/2008/05/potential_flash_player_issue.html↗www.us-cert.govhttp://www.us-cert.gov/cas/techalerts/TA08-149A.html↗www.vupen.comhttp://www.vupen.com/english/advisories/2008/1662/references↗secunia.comhttp://secunia.com/advisories/29865↗www.securityfocus.comhttp://www.securityfocus.com/bid/28695↗