[Bug 239213] New: CVE-2007-2500: gnash arbitrary code execution
bugzilla at redhat.com
bugzilla at redhat.com
Sun May 6 06:35:07 UTC 2007
Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=239213
Summary: CVE-2007-2500: gnash arbitrary code execution
Product: Fedora Extras
Version: fc6
Platform: All
OS/Version: Linux
Status: NEW
Severity: medium
Priority: medium
Component: gnash
AssignedTo: pertusus at free.fr
ReportedBy: ville.skytta at iki.fi
QAContact: extras-qa at fedoraproject.org
CC: fedora-security-list at redhat.com
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2500
"server/parser/sprite_definition.cpp in GNU Gnash (aka GNU Flash Player) 0.7.2
allows remote attackers to execute arbitrary code via a large number of
SHOWFRAME elements within a DEFINESPRITE element, which triggers memory
corruption and enables the attacker to call free with an arbitrary address,
probably resultant from a buffer overflow."
--
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
More information about the Fedora-security-list
mailing list