CVE-2008-5363

The ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, does not validate character elements during retrieval from the dictionary data structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PDF file.

• CWE-399

• http://secunia.com/advisories/33390Third Party Advisory
• http://secunia.com/advisories/34226Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200903-23.xmlThird Party Advisory
• http://securityreason.com/securityalert/4692Third Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1Broken Link
• http://support.avaya.com/elmodocs2/security/ASA-2009-020.htmThird Party Advisory
• http://www.adobe.com/support/security/bulletins/apsb08-22.htmlPatch, Vendor Advisory
• http://www.isecpartners.com/advisories/2008-01-flash.txtThird Party Advisory
• http://www.securityfocus.com/archive/1/498561/100/0/threadedThird Party Advisory, VDB Entry
• http://secunia.com/advisories/33390Third Party Advisory
• http://secunia.com/advisories/34226Third Party Advisory
• http://security.gentoo.org/glsa/glsa-200903-23.xmlThird Party Advisory
• http://securityreason.com/securityalert/4692Third Party Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1Broken Link
• http://support.avaya.com/elmodocs2/security/ASA-2009-020.htmThird Party Advisory
• http://www.adobe.com/support/security/bulletins/apsb08-22.htmlPatch, Vendor Advisory
• http://www.isecpartners.com/advisories/2008-01-flash.txtThird Party Advisory
• http://www.securityfocus.com/archive/1/498561/100/0/threadedThird Party Advisory, VDB Entry

Published

Dec 8, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-5357Integer overflow in Java Runtime Environment (JRE) for Sun J…
• CVE-2008-5358Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update …
• CVE-2008-5359Buffer overflow in Java Runtime Environment (JRE) for Sun JD…
• CVE-2008-5360Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update …
• CVE-2008-5361The ActionScript 2 virtual machine in Adobe Flash Player 10.…
• CVE-2008-5362The DefineConstantPool action in the ActionScript 2 virtual …
• CVE-2008-5364Stack-based buffer overflow in the getPlus ActiveX control i…
• CVE-2008-5365SQL injection vulnerability in VoteHistory.asp in ActiveWebS…
• CVE-2008-5366The postinst script in ppp 2.4.4rel on Debian GNU/Linux allo…
• CVE-2008-5367ip-up in ppp-udeb 2.4.4rel on Debian GNU/Linux allows local …
• CVE-2008-5368muttprint in muttprint 0.72d allows local users to overwrite…
• CVE-2008-5369noip2 in noip2 2.1.7 allows local users to overwrite arbitra…