CVE-2008-4824: adobe flash_player Improper Input Validation

CVSS: 9.3v2.0HighModified

Published 17-11-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-4824 is a high (CVSS 9.3) Improper Input Validation vulnerability in adobe flash_player. EPSS estimates a 13.25% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

13.25%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2

RHSA-2008:0945 RHSA-2008:0980

Timeline

17-11-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Multiple unspecified vulnerabilities in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0 allow remote attackers to execute arbitrary code via unknown vectors related to "input validation errors."

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

13.25%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

0.00 pp

From 13.25% on 20-09-2026

20-09-202620-10-2026

EPSS score

13.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Adobe1 product

flash_player≥ 9.0.16.0, < 9.0.151.0 | ≥ 10, < 10.0.12.36

1 vendor · 1 product

References

19 links

support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=834256&poid=X Refsource CONFIRMBroken Link
www.securityfocus.com/archive/1/498561/100/0/threadedMailing ListX Refsource BUGTRAQThird Party AdvisoryVDB Entry
secunia.com/advisories/33390Third Party AdvisoryX Refsource SECUNIA
www.isecpartners.com/advisories/2008-01-flash.txtX Refsource MISCThird Party Advisory
support.avaya.com/elmodocs2/security/ASA-2009-020.htmX Refsource CONFIRMThird Party Advisory
www.vupen.com/english/advisories/2008/3444VDB EntryX Refsource VUPENThird Party Advisory
secunia.com/advisories/32702Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2008/3189VDB EntryX Refsource VUPENThird Party Advisory
www.us-cert.gov/cas/techalerts/TA08-350A.htmlThird Party AdvisoryX Refsource CERTUS Government Resource
secunia.com/advisories/33179Third Party AdvisoryX Refsource SECUNIA

Show all 19 references

secunia.com/advisories/34226Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200903-23.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
support.apple.com/kb/HT3338X Refsource CONFIRMThird Party Advisory
osvdb.org/49958VDB EntryX Refsource OSVDBBroken Link
www.redhat.com/support/errata/RHSA-2008-0980.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.apple.com/archives/security-announce//2008//Dec/msg00000.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
secunia.com/advisories/32772Third Party AdvisoryX Refsource SECUNIA
sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1Vendor AdvisoryX Refsource SUNALERTBroken Link
www.adobe.com/support/security/bulletins/apsb08-22.htmlX Refsource CONFIRMPatchVendor Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities