National Cyber-Alert System

Vulnerability Summary for CVE-2007-6244

Overview

Multiple cross-site scripting (XSS) vulnerabilities in Adobe Flash Player 9.x up to 9.0.48.0 and 8.x up to 8.0.35.0 allow remote attackers to inject arbitrary web script or HTML via (1) a SWF file that uses the asfunction: protocol or (2) the navigateToURL function when used with the Flash Player ActiveX Control in Internet Explorer.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA07-355A

Name: TA07-355A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA07-355A.html

US-CERT Vulnerability Note: VU#758769

Name: VU#758769

Hyperlink:http://www.kb.cert.org/vuls/id/758769

External Source: CONFIRM

Name: http://www.adobe.com/support/security/bulletins/apsb07-20.html

Hyperlink:http://www.adobe.com/support/security/bulletins/apsb07-20.html

External Source: XF

Name: adobe-navigatetourl-xss(39131)

Hyperlink:http://xforce.iss.net/xforce/xfdb/39131

External Source: XF

Name: adobe-asfunction-protocol-xss(39130)

Hyperlink:http://xforce.iss.net/xforce/xfdb/39130

External Source: BID

Name: 26960

Hyperlink:http://www.securityfocus.com/bid/26960

External Source: BID

Name: 26949

Hyperlink:http://www.securityfocus.com/bid/26949

External Source: BID

Name: 26929

Hyperlink:http://www.securityfocus.com/bid/26929

External Source: REDHAT

Name: RHSA-2007:1126

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-1126.html

External Source: GENTOO

Name: GLSA-200801-07

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-200801-07.xml

External Source: VUPEN

Name: ADV-2008-1724

Hyperlink:http://www.frsirt.com/english/advisories/2008/1724/references

External Source: VUPEN

Name: ADV-2007-4258

Hyperlink:http://www.frsirt.com/english/advisories/2007/4258

External Source: SUNALERT

Name: 238305

Hyperlink:http://sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1

External Source: SECTRACK

Name: 1019116

Hyperlink:http://securitytracker.com/id?1019116

External Source: SECUNIA

Name: 30507

Hyperlink:http://secunia.com/advisories/30507

External Source: SECUNIA

Name: 28570

Hyperlink:http://secunia.com/advisories/28570

External Source: SECUNIA

Name: 28213

Hyperlink:http://secunia.com/advisories/28213

External Source: SECUNIA

Name: 28161

Hyperlink:http://secunia.com/advisories/28161

External Source: SECUNIA

Name: 28157

Hyperlink:http://secunia.com/advisories/28157

External Source: SUSE

Name: SUSE-SA:2007:069

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html

External Source: MISC

Name: http://crypto.stanford.edu/advisories/CVE-2007-6244/

Hyperlink:http://crypto.stanford.edu/advisories/CVE-2007-6244/