CRLF injection vulnerability in Adobe Flash Player plugin 9.0.16 and earlier for Windows, 7.0.63 and earlier for Linux, 7.x before 7.0 r67 for Solaris, and before 9.0.28.0 for Mac OS X, allows remote attackers to modify HTTP headers of client requests and conduct HTTP Request Splitting attacks via CRLF sequences in arguments to the ActionScript functions (1) XML.addRequestHeader and (2) XML.contentType. NOTE: the flexibility of the attack varies depending on the type of web browser being used.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Adobe Flash Apsb06 18 | — | Upgrade to Adobe Flash Player version 9.0.28.0 for Mac OS XUpgrade to Adobe Flash Player version 9.0.28.0 for WindowsUpgrade to Adobe Flash Player version 9.0.28.0 for Linux | Nov 19, 2012 | Oct 17, 2006 |
| Apple Osx Flashplayer | — | Upgrade macOS to the latest versionApply OS X security update 2007-003 | Dec 16, 2011 | Oct 17, 2006 |
| Suse | — | Upgrade amarokUpgrade kdenetwork3-newsUpgrade kdenetwork3-wirelessUpgrade kdepim3-develUpgrade amarok-libvisualUpgrade kdemultimedia3-CDUpgrade kdemultimedia3-mixerUpgrade flash-playerUpgrade kdepim3-time-managementUpgrade kdenetwork3-lisaUpgrade beagle-indexUpgrade kdeaddons3-konquerorUpgrade kdemultimedia3-videoUpgrade krecordUpgrade kdemultimedia3Upgrade kdepim3-networkstatusUpgrade kdeaddons3-kickerUpgrade amarok-xineUpgrade kdepim3-mobileUpgrade kscpmUpgrade kdenetwork3-dialupUpgrade kdeaddons3-kateUpgrade kdenetwork3-vncUpgrade kdenetwork3-lanUpgrade kdepim3-syncUpgrade gtk-qt-engineUpgrade digikamUpgrade kdenetwork3-InstantMessengerUpgrade kdemultimedia3-develUpgrade NetworkManager-kdeUpgrade kdenetwork3-IRCUpgrade digikamimagepluginsUpgrade kdenetwork3Upgrade yast2-CASAUpgrade kerryUpgrade kdenetwork3-queryUpgrade kinternetUpgrade kdepim3Upgrade kdepim3-kpilotUpgrade suse-releaseUpgrade kdemultimedia3-soundUpgrade gtk-qt-engine-32bit | Feb 17, 2015 | Oct 17, 2006 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub