Every CVE Search/ Get API key

CVE-2008-4546

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610,...

4.3 MediumPublic exploitFix available

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF version numbers.

Exploit likelihood

65.9%Up 37.8 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF version numbers.

Record
CVE-2008-4546
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE List No score

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF version numbers.

Record
CVE-2008-4546
Updated
2026-11-02
EUVDEUVD-2008-4527 No score

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF version numbers.

Record
EUVD-2008-4527
Updated
2026-11-03
GitHub AdvisoriesGHSA-5xqh-j4c7-9pg5 No score

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610,...

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows remote web servers to cause a denial of service (NULL pointer dereference and browser crash) by returning a different response when an HTTP request is sent a second time, as demonstrated by two responses that provide SWF files with different SWF version numbers.

Record
GHSA-5xqh-j4c7-9pg5
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
flash-plugin
Red Hat:rhel_extras:5::client
 before 0:10.1-2.el5
0:10.1-2.el5
flash-plugin
Red Hat:rhel_extras:5::server
 before 0:10.1-2.el5
0:10.1-2.el5
flash-plugin
Red Hat:rhel_extras:3
 before 0:9.0.277.0-1.el3.with.oss
0:9.0.277.0-1.el3.with.oss
flash-plugin
Red Hat:rhel_extras:4
 before 0:9.0.277.0-1.el4
0:9.0.277.0-1.el4

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBAdobe Flash Player 9/10 - SWF Version Null Pointer Dereference Denial of Service2008-10-02

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2008-4546 is a medium vulnerability (CVSS 4.3) in Adobe Flash Player, published October 14, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 65.9%, the 99th percentile. Fixed in flash-plugin 0:10.1-2.el5.

References

Show 131 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open