CVE-2008-4401

ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.

Link	Resource
http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html
http://securitytracker.com/id?1021061
http://www.adobe.com/support/security/bulletins/apsb08-18.html	Patch Vendor Advisory
http://secunia.com/advisories/32270	Patch Vendor Advisory
http://secunia.com/advisories/32448
http://www.redhat.com/support/errata/RHSA-2008-0945.html
http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html
http://secunia.com/advisories/32759
http://secunia.com/advisories/32702
http://www.redhat.com/support/errata/RHSA-2008-0980.html
http://secunia.com/advisories/33390
http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1
http://security.gentoo.org/glsa/glsa-200903-23.xml
http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm
http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm
http://secunia.com/advisories/34226
http://www.vupen.com/english/advisories/2008/2838
https://exchange.xforce.ibmcloud.com/vulnerabilities/45913

Configuration 1

cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.0_r67:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:* cpe:2.3:a:adobe:flash_player:9.0:*:*:*:*:*:*:*

---

Published : 2008-10-17 07:31

Updated : 2018-10-30 04:26

---

NVD link : CVE-2008-4401

Mitre link : CVE-2008-4401

No products.

CWE-264