CVE-2007-0071: adobe flash_player Numeric Errors
CVSS: 9.3v2.0HighModified
Published 09-04-2008Last modified 07-08-2024
Vulnerability summary
CVE-2007-0071 is a high (CVSS 9.3) Numeric Errors vulnerability in adobe flash_player. EPSS estimates a 92.50% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities.
CVSS score
9.3/10
010
High · v2.0 (NVD)EPSS score
92.50%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 09-04-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Integer overflow in Adobe Flash Player 9.0.115.0 and earlier, and 8.0.39.0 and earlier, allows remote attackers to execute arbitrary code via a crafted SWF file with a negative Scene Count value, which passes a signed comparison, is used as an offset of a NULL pointer, and triggers a buffer overflow.
CVSS metrics
1 score · 1 source · 1 versionHigh 9.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
92.50%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 92.50% on 20-09-2026
20-09-202620-10-2026
EPSS score92.50%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Adobe1 product
- flash_player≥ 8.0, ≤ 8.0.39.0 | ≥ 9.0, ≤ 9.0.115.0
1 vendor · 1 product
References
32 links- www.us-cert.gov/cas/techalerts/TA08-149A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
- www.matasano.com/log/1032/this-new-vulnerability-dowds-inhuman-flash-exploit/X Refsource MISCThird Party Advisory
Show all 32 references
- www.redhat.com/support/errata/RHSA-2008-0221.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- www.us-cert.gov/cas/techalerts/TA08-150A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10379VDB EntrySignatureX Refsource OVALThird Party Advisory
- lists.apple.com/archives/security-announce/2008//May/msg00001.htmlVendor AdvisoryX Refsource APPLEMailing List
- lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1Vendor AdvisoryX Refsource SUNALERTBroken Link
- www.gentoo.org/security/en/glsa/glsa-200804-21.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
- www.us-cert.gov/cas/techalerts/TA08-100A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource