CVE-2007-3456

Integer overflow in Adobe Flash Player 9.0.45.0 and earlier might allow remote attackers to execute arbitrary code via a large length value for a (1) Long string or (2) XML variable type in a crafted (a) FLV or (b) SWF file, related to an "input validation error," including a signed comparison of values that are assumed to be non-negative.

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

47.71% chance of exploitation in the next 30 days, 99th percentile

Published

2007-07-11

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/30288

Security advisories

• http://secunia.com/advisories/26027
• http://secunia.com/advisories/26057
• http://secunia.com/advisories/26118
• http://secunia.com/advisories/26357
• http://secunia.com/advisories/27643
• http://secunia.com/advisories/28068
• http://www.adobe.com/support/security/bulletins/apsb07-12.html
• http://www.vupen.com/english/advisories/2007/2497
• http://www.vupen.com/english/advisories/2007/3868
• http://www.vupen.com/english/advisories/2007/4190
• http://www.kb.cert.org/vuls/id/730785
• http://www.securityfocus.com/bid/24856
• http://www.securityfocus.com/bid/26444

References

• CVE Record
• NVD entry