CVE-2007-5275
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to...
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
Exploit likelihood
What each source reports
NVD Score used
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
- Record
CVE-2007-5275- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
- Record
CVE-2007-5275- Updated
- 2026-11-02
EUVDEUVD-2007-5255 No score
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
- Record
EUVD-2007-5255- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwqr-x6x9-wjxj No score
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to...
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
- Record
GHSA-pwqr-x6x9-wjxj- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-pluginRed Hat:rhel_extras:3 From an advisory covering 8 CVEs |
before 0:9.0.115.0-1.el3.with.oss | 0:9.0.115.0-1.el3.with.oss |
flash-pluginRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 0:9.0.115.0-1.el4 | 0:9.0.115.0-1.el4 |
flash-pluginRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 0:9.0.115.0-1.el5 | 0:9.0.115.0-1.el5 |
flash-pluginRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 0:9.0.115.0-1.el5 | 0:9.0.115.0-1.el5 |
flash-pluginRed Hat:rhel_extras:3 From an advisory covering 8 CVEs |
before 0:9.0.124.0-1.el3.with.oss | 0:9.0.124.0-1.el3.with.oss |
flash-pluginRed Hat:rhel_extras:4 From an advisory covering 8 CVEs |
before 0:9.0.124.0-1.el4 | 0:9.0.124.0-1.el4 |
flash-pluginRed Hat:rhel_extras:5::client From an advisory covering 8 CVEs |
before 0:9.0.124.0-1.el5 | 0:9.0.124.0-1.el5 |
flash-pluginRed Hat:rhel_extras:5::server From an advisory covering 8 CVEs |
before 0:9.0.124.0-1.el5 | 0:9.0.124.0-1.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5275 is a medium vulnerability (CVSS 5.0) in Adobe Shockwave Player, published October 8, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.15%, the 93rd percentile. No source names a fixed version.
References
lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html
secunia.com/advisories/29865
crypto.stanford.edu/dns/dns-rebinding.pdf
Show 84 moreShow less
adobe.com/support/security/bulletins/apsb08-11.html
vupen.com/english/advisories/2008/1724/references
us-cert.gov/cas/techalerts/TA07-355A.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9250
gentoo.org/security/en/glsa/glsa-200801-07.xml
redhat.com/support/errata/RHSA-2008-0221.html
lists.apple.com/archives/security-announce/2008//May/msg00001.html
sunsolve.sun.com/search/document.do?assetkey=1-26-238305-1
securityfocus.com/bid/26930
securitytracker.com/id?1019116
nvd.nist.gov/vuln/detail/CVE-2007-5275
github.com/advisories/GHSA-pwqr-x6x9-wjxj
access.redhat.com/errata/RHSA-2007:1126
bugzilla.redhat.com/show_bug.cgi?id=252292
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_1126.json
cve.org/CVERecord?id=CVE-2007-4324