Adobe Flash Player Multiple Remote Code Execution Vulnerabilities

BID:19980

CVE-2006-3014 | CVE-2006-3311 | CVE-2006-3587 | CVE-2006-3588 | CVE-2006-4640 |

Info

Adobe Flash Player Multiple Remote Code Execution Vulnerabilities

Bugtraq ID: 19980
Class: Design Error
CVE: CVE-2006-3587
CVE-2006-3014
CVE-2006-3311
CVE-2006-3588
CVE-2006-4640
Remote: Yes
Local: No
Published: Sep 12 2006 12:00AM
Updated: May 14 2008 08:55PM
Credit: Stuart Pearson of Computer Terrorism (UK) Ltd is credited with the discovery of this vulnerability.
Vulnerable: Turbolinux Turbolinux FUJI
S.u.S.E. Novell Linux Desktop 9.0
S.u.S.E. Linux Professional 10.0 OSS
S.u.S.E. Linux Professional 10.0
S.u.S.E. Linux Professional 9.3 x86_64
S.u.S.E. Linux Professional 9.3
S.u.S.E. Linux Professional 9.2 x86_64
S.u.S.E. Linux Professional 9.2
S.u.S.E. Linux Professional 10.1
S.u.S.E. Linux Personal 10.0 OSS
S.u.S.E. Linux Personal 9.3 x86_64
S.u.S.E. Linux Personal 9.3
S.u.S.E. Linux Personal 9.2 x86_64
S.u.S.E. Linux Personal 9.2
S.u.S.E. Linux Personal 10.1
Redhat Enterprise Linux WS 4
Redhat Enterprise Linux WS 3
Redhat Enterprise Linux ES 4
Redhat Enterprise Linux ES 3
Redhat Enterprise Linux AS 4
Redhat Enterprise Linux AS 3
Nortel Networks Self-Service Peri NT Server 0
Nortel Networks Self-Service Peri IVR 0
Nortel Networks Enterprise Network Management System
Microsoft Windows XP Tablet PC Edition SP3
Microsoft Windows XP Tablet PC Edition SP2
Microsoft Windows XP Tablet PC Edition SP1
Microsoft Windows XP Tablet PC Edition
Microsoft Windows XP Professional x64 Edition SP3
Microsoft Windows XP Professional x64 Edition SP2
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Professional SP3
Microsoft Windows XP Professional SP2
Microsoft Windows XP Professional SP1
Microsoft Windows XP Professional
Microsoft Windows XP Media Center Edition SP3
Microsoft Windows XP Media Center Edition SP2
Microsoft Windows XP Media Center Edition SP1
Microsoft Windows XP Media Center Edition
Microsoft Windows XP Home SP3
Microsoft Windows XP Home SP2
Microsoft Windows XP Home SP1
Microsoft Windows XP Home
Microsoft Windows XP Embedded SP1
Microsoft Windows XP Embedded
Microsoft Windows XP 64-bit Edition Version 2003 SP1
Microsoft Windows XP 64-bit Edition Version 2003
Microsoft Windows XP 64-bit Edition SP1
Microsoft Windows XP 64-bit Edition
Macromedia Flex 1.5
Macromedia Flash Professional MX 2004
Macromedia Flash MX 2004 7.0.63 .0
Macromedia Flash MX 2004
Macromedia Flash Basic 0
Macromedia Flash 8.0.24 .0
Macromedia Flash 8.0.22 .0
Macromedia Flash 7.0.63 .0
Macromedia Flash 7.0.61 .0
Macromedia Flash 7.0.60 .0
Macromedia Flash 7.0.25 .0
Macromedia Flash 7.0.19 .0
Macromedia Flash 7.0 r19
Macromedia Flash 6.0.79 .0
Macromedia Flash 6.0.65 .0
Macromedia Flash 6.0.47 .0
Macromedia Flash 6.0.40 .0
Macromedia Flash 6.0.29 .0
Macromedia Flash 6.0
Macromedia Flash 5.0 r50
Macromedia Flash 5.0
- Microsoft Windows 2000 Advanced Server SP2
 - Microsoft Windows 2000 Advanced Server SP1
 - Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional SP2
 - Microsoft Windows 2000 Professional SP1
 - Microsoft Windows 2000 Professional
- Microsoft Windows 2000 Server SP2
 - Microsoft Windows 2000 Server SP1
 - Microsoft Windows 2000 Server
- Microsoft Windows 95 SR2
 - Microsoft Windows 95
- Microsoft Windows 98
- Microsoft Windows 98SE
- Microsoft Windows ME
- Microsoft Windows NT Enterprise Server 4.0 SP6a
 - Microsoft Windows NT Enterprise Server 4.0 SP6
 - Microsoft Windows NT Enterprise Server 4.0 SP5
 - Microsoft Windows NT Enterprise Server 4.0 SP4
 - Microsoft Windows NT Enterprise Server 4.0 SP3
 - Microsoft Windows NT Enterprise Server 4.0 SP2
 - Microsoft Windows NT Enterprise Server 4.0 SP1
 - Microsoft Windows NT Enterprise Server 4.0
 - Microsoft Windows NT Server 4.0 SP6a
 - Microsoft Windows NT Server 4.0 SP6
 - Microsoft Windows NT Server 4.0 SP5
 - Microsoft Windows NT Server 4.0 SP4
 - Microsoft Windows NT Server 4.0 SP3
 - Microsoft Windows NT Server 4.0 SP2
 - Microsoft Windows NT Server 4.0 SP1
 - Microsoft Windows NT Server 4.0
 - Microsoft Windows NT Workstation 4.0 SP6a
 - Microsoft Windows NT Workstation 4.0 SP6
 - Microsoft Windows NT Workstation 4.0 SP5
 - Microsoft Windows NT Workstation 4.0 SP4
 - Microsoft Windows NT Workstation 4.0 SP3
 - Microsoft Windows NT Workstation 4.0 SP2
 - Microsoft Windows NT Workstation 4.0 SP1
 - Microsoft Windows NT Workstation 4.0
 - Microsoft Windows XP Home
- Microsoft Windows XP Professional
Macromedia Flash 4.0 r12
Gentoo net-www/netscape-flash 7.0.68
Apple Mac OS X Server 10.4.7
Apple Mac OS X Server 10.4.6
Apple Mac OS X Server 10.4.5
Apple Mac OS X Server 10.4.4
Apple Mac OS X Server 10.4.3
Apple Mac OS X Server 10.4.2
Apple Mac OS X Server 10.4.1
Apple Mac OS X Server 10.4
Apple Mac OS X Server 10.3.9
Apple Mac OS X Server 10.3.8
Apple Mac OS X Server 10.3.7
Apple Mac OS X Server 10.3.6
Apple Mac OS X Server 10.3.5
Apple Mac OS X Server 10.3.4
Apple Mac OS X Server 10.3.3
Apple Mac OS X Server 10.3.2
Apple Mac OS X Server 10.3.1
Apple Mac OS X Server 10.3
Apple Mac OS X 10.4.7
Apple Mac OS X 10.4.6
Apple Mac OS X 10.4.5
Apple Mac OS X 10.4.4
Apple Mac OS X 10.4.3
Apple Mac OS X 10.4.2
Apple Mac OS X 10.4.1
Apple Mac OS X 10.4
Apple Mac OS X 10.3.9
Apple Mac OS X 10.3.8
Apple Mac OS X 10.3.7
Apple Mac OS X 10.3.6
Apple Mac OS X 10.3.5
Apple Mac OS X 10.3.4
Apple Mac OS X 10.3.3
Apple Mac OS X 10.3.2
Apple Mac OS X 10.3.1
Apple Mac OS X 10.3
Not Vulnerable: Macromedia Flash 8.0.33.0
Macromedia Flash 7.0.68.0
Macromedia Flash 7.0.66.0
Macromedia Flash 6.0.88.0

Discussion

Adobe Flash Player Multiple Remote Code Execution Vulnerabilities

Adobe Flash Player is prone to multiple remote code-execution vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could exploit this issue by creating a media file containing large, dynamically generated string data and submitting it to be processed by the media player.

These issues allow remote attackers to execute arbitrary machine code in the context of the user running the application. Other attacks are also possible.

Adobe Flash Player 8.0.24.0 and prior, Adobe Flash Professional 8, Flash Basic, Adobe Flash MX, and 2004Adobe Flex 1.5 are affected.

Exploit / POC

Adobe Flash Player Multiple Remote Code Execution Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

Solution / Fix

Adobe Flash Player Multiple Remote Code Execution Vulnerabilities

Solution:
The vendor has released a fix. Please see the references for more information.


Microsoft Windows XP Media Center Edition SP2

Macromedia Flash Basic 0

Microsoft Windows XP Tablet PC Edition SP2

Macromedia Flash MX 2004

Microsoft Windows XP Home SP2

Macromedia Flex 1.5

Apple Mac OS X Server 10.3.9

Apple Mac OS X 10.3.9

Apple Mac OS X 10.4

Apple Mac OS X Server 10.4

Apple Mac OS X 10.4.2

Apple Mac OS X Server 10.4.3

Apple Mac OS X 10.4.3

Apple Mac OS X Server 10.4.4

Apple Mac OS X 10.4.4

Apple Mac OS X Server 10.4.5

Apple Mac OS X 10.4.5

Apple Mac OS X Server 10.4.6

Apple Mac OS X Server 10.4.7

Apple Mac OS X 10.4.7

References

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report