Vulnerability-Lookup

CVE-2006-3311 (GCVE-0-2006-3311)

Vulnerability from cvelistv5 – Published: 2006-09-12 23:00 – Updated: 2024-08-07 18:23

Summary

Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.

Severity

No CVSS data available.

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 29/100 over 2267 records in the last 180 days details

References

26 references

URL	Tags
http://www.vupen.com/english/advisories/2006/3573	vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/22054	third-party-advisoryx_refsource_SECUNIA
http://www.us-cert.gov/cas/techalerts/TA06-318A.html	third-party-advisoryx_refsource_CERT
http://secunia.com/advisories/22268	third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2006/4507	vdb-entryx_refsource_VUPEN
http://www.kb.cert.org/vuls/id/451380	third-party-advisoryx_refsource_CERT-VN
http://www.securityfocus.com/bid/19980	vdb-entryx_refsource_BID
http://www.computerterrorism.com/research/ct12-09…	x_refsource_MISC
http://secunia.com/advisories/22187	third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2006/3852	vdb-entryx_refsource_VUPEN
http://secunia.com/advisories/22882	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/21865	third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://securityreason.com/securityalert/1546	third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/445825/100…	mailing-listx_refsource_BUGTRAQ
http://www.novell.com/linux/security/advisories/2…	vendor-advisoryx_refsource_SUSE
http://securitytracker.com/id?1016829	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/21901	third-party-advisoryx_refsource_SECUNIA
http://www.adobe.com/support/security/bulletins/a…	x_refsource_CONFIRM
http://www.redhat.com/support/errata/RHSA-2006-06…	vendor-advisoryx_refsource_REDHAT
http://www.vupen.com/english/advisories/2006/3577	vdb-entryx_refsource_VUPEN
http://www.us-cert.gov/cas/techalerts/TA06-275A.html	third-party-advisoryx_refsource_CERT
https://docs.microsoft.com/en-us/security-updates…	vendor-advisoryx_refsource_MS
http://security.gentoo.org/glsa/glsa-200610-02.xml	vendor-advisoryx_refsource_GENTOO

Date Public

2006-09-12 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T18:23:21.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2006-3573",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/3573"
          },
          {
            "name": "22054",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/22054"
          },
          {
            "name": "TA06-318A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
          },
          {
            "name": "22268",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/22268"
          },
          {
            "name": "ADV-2006-4507",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/4507"
          },
          {
            "name": "VU#451380",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/451380"
          },
          {
            "name": "19980",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/19980"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
          },
          {
            "name": "22187",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/22187"
          },
          {
            "name": "ADV-2006-3852",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/3852"
          },
          {
            "name": "22882",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/22882"
          },
          {
            "name": "21865",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21865"
          },
          {
            "name": "flashplayer-swf-string-bo(28886)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
          },
          {
            "name": "APPLE-SA-2006-09-29",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
          },
          {
            "name": "oval:org.mitre.oval:def:394",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
          },
          {
            "name": "1546",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/1546"
          },
          {
            "name": "20060912 Computer Terrorism (UK) :: Incident Response Centre - Adobe/Macromedia Flash Player Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
          },
          {
            "name": "SUSE-SA:2006:053",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
          },
          {
            "name": "1016829",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1016829"
          },
          {
            "name": "21901",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/21901"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
          },
          {
            "name": "RHSA-2006:0674",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
          },
          {
            "name": "ADV-2006-3577",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/3577"
          },
          {
            "name": "TA06-275A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
          },
          {
            "name": "MS06-069",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
          },
          {
            "name": "GLSA-200610-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-09-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-18T14:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2006-3573",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/3573"
        },
        {
          "name": "22054",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/22054"
        },
        {
          "name": "TA06-318A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
        },
        {
          "name": "22268",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/22268"
        },
        {
          "name": "ADV-2006-4507",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/4507"
        },
        {
          "name": "VU#451380",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/451380"
        },
        {
          "name": "19980",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/19980"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
        },
        {
          "name": "22187",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/22187"
        },
        {
          "name": "ADV-2006-3852",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/3852"
        },
        {
          "name": "22882",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/22882"
        },
        {
          "name": "21865",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21865"
        },
        {
          "name": "flashplayer-swf-string-bo(28886)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
        },
        {
          "name": "APPLE-SA-2006-09-29",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
        },
        {
          "name": "oval:org.mitre.oval:def:394",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
        },
        {
          "name": "1546",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/1546"
        },
        {
          "name": "20060912 Computer Terrorism (UK) :: Incident Response Centre - Adobe/Macromedia Flash Player Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
        },
        {
          "name": "SUSE-SA:2006:053",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
        },
        {
          "name": "1016829",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1016829"
        },
        {
          "name": "21901",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/21901"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
        },
        {
          "name": "RHSA-2006:0674",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
        },
        {
          "name": "ADV-2006-3577",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/3577"
        },
        {
          "name": "TA06-275A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
        },
        {
          "name": "MS06-069",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
        },
        {
          "name": "GLSA-200610-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-3311",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2006-3573",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/3573"
            },
            {
              "name": "22054",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/22054"
            },
            {
              "name": "TA06-318A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
            },
            {
              "name": "22268",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/22268"
            },
            {
              "name": "ADV-2006-4507",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/4507"
            },
            {
              "name": "VU#451380",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/451380"
            },
            {
              "name": "19980",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/19980"
            },
            {
              "name": "http://www.computerterrorism.com/research/ct12-09-2006.htm",
              "refsource": "MISC",
              "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
            },
            {
              "name": "22187",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/22187"
            },
            {
              "name": "ADV-2006-3852",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/3852"
            },
            {
              "name": "22882",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/22882"
            },
            {
              "name": "21865",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21865"
            },
            {
              "name": "flashplayer-swf-string-bo(28886)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
            },
            {
              "name": "APPLE-SA-2006-09-29",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
            },
            {
              "name": "oval:org.mitre.oval:def:394",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
            },
            {
              "name": "1546",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/1546"
            },
            {
              "name": "20060912 Computer Terrorism (UK) :: Incident Response Centre - Adobe/Macromedia Flash Player Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
            },
            {
              "name": "SUSE-SA:2006:053",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
            },
            {
              "name": "1016829",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1016829"
            },
            {
              "name": "21901",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/21901"
            },
            {
              "name": "http://www.adobe.com/support/security/bulletins/apsb06-11.html",
              "refsource": "CONFIRM",
              "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
            },
            {
              "name": "RHSA-2006:0674",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
            },
            {
              "name": "ADV-2006-3577",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/3577"
            },
            {
              "name": "TA06-275A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
            },
            {
              "name": "MS06-069",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
            },
            {
              "name": "GLSA-200610-02",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-3311",
    "datePublished": "2006-09-12T23:00:00.000Z",
    "dateReserved": "2006-06-29T00:00:00.000Z",
    "dateUpdated": "2024-08-07T18:23:21.156Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2006-3311",
      "date": "2026-10-28",
      "epss": "0.17902",
      "percentile": "0.97166"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8D18545D-9EE5-4AC5-9A44-0C548AFA691A",
                    "versionEndIncluding": "8.0.24.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adobe:flash_player:8:*:pro:*:*:*:*:*",
                    "matchCriteriaId": "9D344A18-4D7B-4B9C-8A8D-AE765FCA32C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adobe:flash_player:mx_2004:*:*:*:*:*:*:*",
                    "matchCriteriaId": "33446303-71A3-4676-8D1D-E1E6EEF46BA9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:adobe:flex_sdk:1.5:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BF76C783-F118-4421-97D9-836172CE812A",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie."
          },
          {
            "lang": "es",
            "value": "Desbordamiento de b\u00fafer en Adobe Flash Player 8.0.24.0 y anteriores, Flash Professional 8, Flash MX 2004, y Flex 1.5 permite a un atacante con la complicidad del usuario ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una cadena grande y creada dinamicamente en una pel\u00edcula SWF."
          }
        ],
        "id": "CVE-2006-3311",
        "lastModified": "2026-04-16T00:27:16.627",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "HIGH",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 5.1,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 4.9,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": true,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ]
        },
        "published": "2006-09-12T23:07:00.000",
        "references": [
          {
            "source": "cve@mitre.org",
            "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/21865"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/21901"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/22054"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/22187"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/22268"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://secunia.com/advisories/22882"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securityreason.com/securityalert/1546"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://securitytracker.com/id?1016829"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Patch"
            ],
            "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Exploit",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.kb.cert.org/vuls/id/451380"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/bid/19980"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2006/3573"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2006/3577"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2006/3852"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.vupen.com/english/advisories/2006/4507"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/21865"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/21901"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/22054"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/22187"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/22268"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://secunia.com/advisories/22882"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securityreason.com/securityalert/1546"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securitytracker.com/id?1016829"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.kb.cert.org/vuls/id/451380"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/19980"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2006/3573"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2006/3577"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2006/3852"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.vupen.com/english/advisories/2006/4507"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Critical",
      "current_release_date": "2026-06-28T11:29:11+00:00",
      "cve": "CVE-2006-3311",
      "id": "CVE-2006-3311",
      "initial_release_date": "2006-09-12T18:00:00+00:00",
      "product_status:fixed": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "security flaw",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2006/cve-2006-3311.json",
      "version": "3"
    }
  }
}

CERTA-2006-AVI-398

Vulnerability from certfr_avis - Published: 2006-09-14 - Updated: 2006-11-15

None

Description

Plusieurs vulnérabilités ont été identifiées dans le lecteur Adobe Flash Player. Elles permettraient à un utilisateur mal intentionné de contourner les restrictions du paramètre de sécurité allowScriptAccess, et d'exécuter du code arbitraire à distance par le biais d'un fichier au format .swf construit de façon particulière. Une dernière vulnérabilité concernerait une mauvaise manipulation de chaînes de caractères dynamiques, et de longueur excessive. Elle pourrait provoquer un débordement de mémoire.

Adobe Flash Player es parfois utilisé indirectement, par le biais d'un navigateur Internet, afin de visualiser des contenus animés au format Flash sur un site web.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Adobe Flash Player versions 8.0.24 et antérieures.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité Adobe du 12 septembre 2006	None	vendor-advisory
Référence CVE CVE-2006-3587 :	-	other
Bulletin de sécurité Microsoft MS06-069 du 14 novembre 2006 :	-	other
Référence CVE CVE-2006-4640 :	-	other
Bulletin de sécurité Microsoft MS06-069 du 14 novembre 2006 :	-	other
Référence CVE CVE-2006-3014 :	-	other
Référence CVE CVE-2006-3588 :	-	other
Référence CVE CVE-2006-3311 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eAdobe Flash Player versions 8.0.24 et  ant\u00e9rieures.\u003c/p\u003e",
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le lecteur Adobe Flash\nPlayer. Elles permettraient \u00e0 un utilisateur mal intentionn\u00e9 de\ncontourner les restrictions du param\u00e8tre de s\u00e9curit\u00e9 allowScriptAccess,\net d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance par le biais d\u0027un fichier au\nformat .swf construit de fa\u00e7on particuli\u00e8re. Une derni\u00e8re vuln\u00e9rabilit\u00e9\nconcernerait une mauvaise manipulation de cha\u00eenes de caract\u00e8res\ndynamiques, et de longueur excessive. Elle pourrait provoquer un\nd\u00e9bordement de m\u00e9moire.\n\nAdobe Flash Player es parfois utilis\u00e9 indirectement, par le biais d\u0027un\nnavigateur Internet, afin de visualiser des contenus anim\u00e9s au format\nFlash sur un site web.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-4640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4640"
    },
    {
      "name": "CVE-2006-3587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3587"
    },
    {
      "name": "CVE-2006-3311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3311"
    },
    {
      "name": "CVE-2006-3014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3014"
    },
    {
      "name": "CVE-2006-3588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3588"
    }
  ],
  "initial_release_date": "2006-09-14T00:00:00",
  "last_revision_date": "2006-11-15T00:00:00",
  "links": [
    {
      "title": "R\u00e9f\u00e9rence CVE CVE-2006-3587 :",
      "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2006-3587"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS06-069 du 14 novembre 2006    :",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS06-069.mspx"
    },
    {
      "title": "R\u00e9f\u00e9rence CVE CVE-2006-4640 :",
      "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2006-4640"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS06-069 du 14 novembre 2006    :",
      "url": "http://www.microsoft.com/france/technet/security/Bulletin/MS06-069.mspx"
    },
    {
      "title": "R\u00e9f\u00e9rence CVE CVE-2006-3014 :",
      "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2006-3014"
    },
    {
      "title": "R\u00e9f\u00e9rence CVE CVE-2006-3588 :",
      "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2006-3588"
    },
    {
      "title": "R\u00e9f\u00e9rence CVE CVE-2006-3311 :",
      "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?CVE-2006-3311"
    }
  ],
  "reference": "CERTA-2006-AVI-398",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-09-14T00:00:00.000000"
    },
    {
      "description": "ajout des r\u00e9f\u00e9rences CVE.",
      "revision_date": "2006-10-03T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin Microsoft MS06-069.",
      "revision_date": "2006-11-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 dans Adobe Flash Player",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe du 12 septembre 2006",
      "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
    }
  ]
}

CERTA-2006-AVI-416

Vulnerability from certfr_avis - Published: 2006-10-03 - Updated: 2006-10-03

Plusieurs vulnérabilités ont été identifiées dans le système d'exploitation Apple Mac OS X, ainsi que certaines applications associées à ce système, telles que Adobe Flash Player, Safari ou QuickDraw. L'exploitation de ces vulnérabilités peut permettre à une personne malveillante d'élever ses privilèges localement, voire d'exécuter des commandes arbitraires à distance.

Description

Plusieurs vulnérabilités ont été identifiées dans le système d'exploitation Apple Mac OS X, ainsi que certaines applications associées à ce système. Parmi celles-ci :

une vulnérabilité dans CFNetwork, une interface de programmation permettant l'abstraction de certaines fonctionnalités des couches réseau : elle ne manipulerait pas correctement les authentifications SSL. Tout client s'appuyant sur elle, comme le navigateur Safari, pourrait donc montrer une connexion SSL authentifiée et chiffrée (icône cadenas dans la fenêtre du navigateur), bien que l'authentification ne soit pas effectuée.
plusieurs vulnérabilités dans l'application Adobe Flash Player, aussi commentées dans l'avis du CERTA CERTA-2006-AVI-398 : celle-ci ne manipulerait pas convenablement certains fichiers multimedia au format .swf, permettant à un document spécialement construit de contourner le paramètre de sécurité nommé allowScriptAccess de l'application vulnérable.
une vulnérabilité dans l'application ImageIO : elle n'interprèterait pas correctement certaines images JPEG2000. Une personne malveillant pourrait construire un document particulier exploitant cette vulnérabilité, afin d'exécuter du code arbitraire lorsque l'image est visualisée sur le système vulnérable.
une vulnérabilité dans la manipulation des erreurs par le noyau de Mac OS X : quand une erreur survient (fermer une application brutalement par exemple), le noyau fait appel à des ports d'exception Mach. Une personne malveillante pourrait profiter des droits accordés à ces derniers pour élever ses privilèges à ceux de l'administrateur (root).
plusieurs vulnérabilités dans l'application LoginWindow : cette application gère notamment les services autorisés aux utilisateurs qui se connecteraient à distance sur le système. Il serait possible pour une personne malveillante de contourner la politique de contrôle d'accès spécifiée dans le système.
une vulnérabilité dans le service Préferences, servant à configurer le système d'exploitation : les privilèges ne seraient pas correctement nettoyés à la suppression d'un compte administrateur.
une vulnérabilité non documentée concernant la manipulation d'images PICT par l'application QuickDraw Manager.
une vulnérabilité dans le service de messagerie Cyrus SASL, au cours de la négaociation DIGEST-MD5 : une personne malveillante pourrait construire un paquet particulier, perturbant le système vulnérable qui le recevrait.
une vulnérabilité de l'utilitaire WebCore : celui-ci est un moteur de rendu HTML pour le système d'exploitation Mac OS X. C'est un des composants primaires repris dans l'utilitaire WebKit. Il ne manipulerait pas correctement certains documents au format HTML, permettant à un utilisateur d'exécuter du code sur le système qui ouvrirait son document construit de manière malveillante.
une vulnérabilité dans le service d'administration Workgroup Manager, qui n'utiliserait pas correctement les mots de passe ShadowHash avec la hiérarchie des domaines de NetInfo.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Apple	N/A	Apple Mac OS X Server v10.4, pour les versions antérieures à 10.4.8.
Apple	N/A	Apple Mac OS X Server version 10.3.9 ;
Apple	N/A	Apple Mac OS X v10.4 , pour les versions antérieures à 10.4.8 ;
Apple	N/A	Apple Mac OS X version 10.3.9 ;

References

Title

Publication Time

Tags

Bulletin de sécurité Apple 2006-006 du 29 septembre 2006	None	vendor-advisory
Bulletin de sécurité Apple du 29 septembre 2006 :	-	other
Avis du CERTA CERTA-2006-AVI-398, 'Vulnérabilités dans Adobe Flash Player', du 14 septembre 2006 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apple Mac OS X Server v10.4, pour les versions ant\u00e9rieures \u00e0 10.4.8.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Apple Mac OS X Server version 10.3.9 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Apple Mac OS X v10.4 , pour les versions ant\u00e9rieures \u00e0 10.4.8 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Apple Mac OS X version 10.3.9 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le syst\u00e8me\nd\u0027exploitation Apple Mac OS X, ainsi que certaines applications\nassoci\u00e9es \u00e0 ce syst\u00e8me. Parmi celles-ci :\n\n-   une vuln\u00e9rabilit\u00e9 dans CFNetwork, une interface de programmation\n    permettant l\u0027abstraction de certaines fonctionnalit\u00e9s des couches\n    r\u00e9seau : elle ne manipulerait pas correctement les authentifications\n    SSL. Tout client s\u0027appuyant sur elle, comme le navigateur Safari,\n    pourrait donc montrer une connexion SSL authentifi\u00e9e et chiffr\u00e9e\n    (ic\u00f4ne cadenas dans la fen\u00eatre du navigateur), bien que\n    l\u0027authentification ne soit pas effectu\u00e9e.\n-   plusieurs vuln\u00e9rabilit\u00e9s dans l\u0027application Adobe Flash Player,\n    aussi comment\u00e9es dans l\u0027avis du CERTA CERTA-2006-AVI-398 : celle-ci\n    ne manipulerait pas convenablement certains fichiers multimedia au\n    format .swf, permettant \u00e0 un document sp\u00e9cialement construit de\n    contourner le param\u00e8tre de s\u00e9curit\u00e9 nomm\u00e9 allowScriptAccess de\n    l\u0027application vuln\u00e9rable.\n-   une vuln\u00e9rabilit\u00e9 dans l\u0027application ImageIO : elle n\u0027interpr\u00e8terait\n    pas correctement certaines images JPEG2000. Une personne malveillant\n    pourrait construire un document particulier exploitant cette\n    vuln\u00e9rabilit\u00e9, afin d\u0027ex\u00e9cuter du code arbitraire lorsque l\u0027image\n    est visualis\u00e9e sur le syst\u00e8me vuln\u00e9rable.\n-   une vuln\u00e9rabilit\u00e9 dans la manipulation des erreurs par le noyau de\n    Mac OS X : quand une erreur survient (fermer une application\n    brutalement par exemple), le noyau fait appel \u00e0 des ports\n    d\u0027exception Mach. Une personne malveillante pourrait profiter des\n    droits accord\u00e9s \u00e0 ces derniers pour \u00e9lever ses privil\u00e8ges \u00e0 ceux de\n    l\u0027administrateur (root).\n-   plusieurs vuln\u00e9rabilit\u00e9s dans l\u0027application LoginWindow : cette\n    application g\u00e8re notamment les services autoris\u00e9s aux utilisateurs\n    qui se connecteraient \u00e0 distance sur le syst\u00e8me. Il serait possible\n    pour une personne malveillante de contourner la politique de\n    contr\u00f4le d\u0027acc\u00e8s sp\u00e9cifi\u00e9e dans le syst\u00e8me.\n-   une vuln\u00e9rabilit\u00e9 dans le service Pr\u00e9ferences, servant \u00e0 configurer\n    le syst\u00e8me d\u0027exploitation : les privil\u00e8ges ne seraient pas\n    correctement nettoy\u00e9s \u00e0 la suppression d\u0027un compte administrateur.\n-   une vuln\u00e9rabilit\u00e9 non document\u00e9e concernant la manipulation d\u0027images\n    PICT par l\u0027application QuickDraw Manager.\n-   une vuln\u00e9rabilit\u00e9 dans le service de messagerie Cyrus SASL, au cours\n    de la n\u00e9gaociation DIGEST-MD5 : une personne malveillante pourrait\n    construire un paquet particulier, perturbant le syst\u00e8me vuln\u00e9rable\n    qui le recevrait.\n-   une vuln\u00e9rabilit\u00e9 de l\u0027utilitaire WebCore : celui-ci est un moteur\n    de rendu HTML pour le syst\u00e8me d\u0027exploitation Mac OS X. C\u0027est un des\n    composants primaires repris dans l\u0027utilitaire WebKit. Il ne\n    manipulerait pas correctement certains documents au format HTML,\n    permettant \u00e0 un utilisateur d\u0027ex\u00e9cuter du code sur le syst\u00e8me qui\n    ouvrirait son document construit de mani\u00e8re malveillante.\n-   une vuln\u00e9rabilit\u00e9 dans le service d\u0027administration Workgroup\n    Manager, qui n\u0027utiliserait pas correctement les mots de passe\n    ShadowHash avec la hi\u00e9rarchie des domaines de NetInfo.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-4640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4640"
    },
    {
      "name": "CVE-2006-3587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3587"
    },
    {
      "name": "CVE-2006-4395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4395"
    },
    {
      "name": "CVE-2006-4397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4397"
    },
    {
      "name": "CVE-2006-4394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4394"
    },
    {
      "name": "CVE-2006-1721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-1721"
    },
    {
      "name": "CVE-2006-4391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4391"
    },
    {
      "name": "CVE-2006-3311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3311"
    },
    {
      "name": "CVE-2006-4390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4390"
    },
    {
      "name": "CVE-2006-4387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4387"
    },
    {
      "name": "CVE-2006-4393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4393"
    },
    {
      "name": "CVE-2006-3588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3588"
    },
    {
      "name": "CVE-2006-3946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3946"
    },
    {
      "name": "CVE-2006-4392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4392"
    },
    {
      "name": "CVE-2006-4399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4399"
    }
  ],
  "initial_release_date": "2006-10-03T00:00:00",
  "last_revision_date": "2006-10-03T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apple du 29 septembre 2006 :",
      "url": "http://docs.info.apple.com/article.html?artnum=304460"
    },
    {
      "title": "Avis du CERTA CERTA-2006-AVI-398, \u0027Vuln\u00e9rabilit\u00e9s dans    Adobe Flash Player\u0027, du 14 septembre 2006 :",
      "url": "http://www.certa/ssi.gouv.fr/site/CERTA-2006-AVI-398/"
    }
  ],
  "reference": "CERTA-2006-AVI-416",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-10-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans le syst\u00e8me\nd\u0027exploitation Apple Mac OS X, ainsi que certaines applications\nassoci\u00e9es \u00e0 ce syst\u00e8me, telles que Adobe Flash Player, Safari ou\nQuickDraw. L\u0027exploitation de ces vuln\u00e9rabilit\u00e9s peut permettre \u00e0 une\npersonne malveillante d\u0027\u00e9lever ses privil\u00e8ges localement, voire\nd\u0027ex\u00e9cuter des commandes arbitraires \u00e0 distance.\n",
  "title": "Plusieurs vuln\u00e9rabilit\u00e9s dans Apple Mac OS X et des applications associ\u00e9es",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Apple 2006-006 du 29 septembre 2006",
      "url": null
    }
  ]
}

CERTA-2006-AVI-498

Vulnerability from certfr_avis - Published: 2006-11-15 - Updated: 2006-11-15

Plusieurs vulnérabilités ont été identifiées dans Adobe Macromedia Flash Player pour Windows. Une personne malveillante pourrait exploiter l'une d'elles afin d'exécuter, à distance, des commandes arbitraires sur la machine vulnérable.

Description

Plusieurs vulnérabilités ont été identifiées dans Adobe Macromedia Flash Player pour Windows. Celles-ci ont été présentées dans l'avis concernant Adobe CERTA-2006-AVI-398, datant du 03 octobre 2006. Microsoft redistribue cependant ces produits avec certaines versions de Microsoft Windows.

Une personne malveillante pourrait exploiter l'une de ces vulnérabilités afin d'exécuter, à distance, des commandes arbitraires sur la machine vulnérable.

Solution

Se référer au bulletin de sécurité MS06-069 de Microsoft pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Adobe	N/A	Microsoft Windows XP Service Pack 2 ;
	Adobe	N/A	Microsoft Windows XP Professional x64 Edition.

References

Title

Publication Time

Tags

Bulletin de sécurité Microsoft MS06-069 du 14 novembre 2006	None	vendor-advisory
Avis du CERTA CERTA-2006-AVI-398 du 03 octobre 2006, « Vulnérabilités dans Adobe Flash Player » :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Windows XP Service Pack 2 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Windows XP Professional x64 Edition.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans Adobe Macromedia Flash\nPlayer pour Windows. Celles-ci ont \u00e9t\u00e9 pr\u00e9sent\u00e9es dans l\u0027avis concernant\nAdobe CERTA-2006-AVI-398, datant du 03 octobre 2006. Microsoft\nredistribue cependant ces produits avec certaines versions de Microsoft\nWindows.\n\nUne personne malveillante pourrait exploiter l\u0027une de ces vuln\u00e9rabilit\u00e9s\nafin d\u0027ex\u00e9cuter, \u00e0 distance, des commandes arbitraires sur la machine\nvuln\u00e9rable.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 MS06-069 de Microsoft pour\nl\u0027obtention des correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-4640",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4640"
    },
    {
      "name": "CVE-2006-3587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3587"
    },
    {
      "name": "CVE-2006-3311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3311"
    },
    {
      "name": "CVE-2006-3014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3014"
    },
    {
      "name": "CVE-2006-3588",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3588"
    }
  ],
  "initial_release_date": "2006-11-15T00:00:00",
  "last_revision_date": "2006-11-15T00:00:00",
  "links": [
    {
      "title": "Avis du CERTA CERTA-2006-AVI-398 du 03 octobre 2006, \u00ab    Vuln\u00e9rabilit\u00e9s dans Adobe Flash Player \u00bb :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-398/"
    }
  ],
  "reference": "CERTA-2006-AVI-498",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-11-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans Adobe Macromedia Flash\nPlayer pour Windows. Une personne malveillante pourrait exploiter l\u0027une\nd\u0027elles afin d\u0027ex\u00e9cuter, \u00e0 distance, des commandes arbitraires sur la\nmachine vuln\u00e9rable.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Adobe Macromedia Flash Player pour Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS06-069 du 14 novembre 2006",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS06-069.mspx"
    }
  ]
}

FKIE_CVE-2006-3311

Vulnerability from fkie_nvd - Published: 2006-09-12 23:07 - Updated: 2026-06-16 22:26

Severity

Summary

References

URL	Tags
cve@mitre.org	http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html
cve@mitre.org	http://secunia.com/advisories/21865	Patch, Vendor Advisory
cve@mitre.org	http://secunia.com/advisories/21901
cve@mitre.org	http://secunia.com/advisories/22054
cve@mitre.org	http://secunia.com/advisories/22187
cve@mitre.org	http://secunia.com/advisories/22268
cve@mitre.org	http://secunia.com/advisories/22882
cve@mitre.org	http://security.gentoo.org/glsa/glsa-200610-02.xml
cve@mitre.org	http://securityreason.com/securityalert/1546
cve@mitre.org	http://securitytracker.com/id?1016829
cve@mitre.org	http://www.adobe.com/support/security/bulletins/apsb06-11.html	Patch
cve@mitre.org	http://www.computerterrorism.com/research/ct12-09-2006.htm	Exploit, Patch, Vendor Advisory
cve@mitre.org	http://www.kb.cert.org/vuls/id/451380	US Government Resource
cve@mitre.org	http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html
cve@mitre.org	http://www.redhat.com/support/errata/RHSA-2006-0674.html
cve@mitre.org	http://www.securityfocus.com/archive/1/445825/100/0/threaded
cve@mitre.org	http://www.securityfocus.com/bid/19980
cve@mitre.org	http://www.us-cert.gov/cas/techalerts/TA06-275A.html	US Government Resource
cve@mitre.org	http://www.us-cert.gov/cas/techalerts/TA06-318A.html	US Government Resource
cve@mitre.org	http://www.vupen.com/english/advisories/2006/3573
cve@mitre.org	http://www.vupen.com/english/advisories/2006/3577
cve@mitre.org	http://www.vupen.com/english/advisories/2006/3852
cve@mitre.org	http://www.vupen.com/english/advisories/2006/4507
cve@mitre.org	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069
cve@mitre.org	https://exchange.xforce.ibmcloud.com/vulnerabilities/28886
cve@mitre.org	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394
af854a3a-2127-422b-91ae-364da2661108	http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/21865	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/21901
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/22054
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/22187
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/22268
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/22882
af854a3a-2127-422b-91ae-364da2661108	http://security.gentoo.org/glsa/glsa-200610-02.xml
af854a3a-2127-422b-91ae-364da2661108	http://securityreason.com/securityalert/1546
af854a3a-2127-422b-91ae-364da2661108	http://securitytracker.com/id?1016829
af854a3a-2127-422b-91ae-364da2661108	http://www.adobe.com/support/security/bulletins/apsb06-11.html	Patch
af854a3a-2127-422b-91ae-364da2661108	http://www.computerterrorism.com/research/ct12-09-2006.htm	Exploit, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.kb.cert.org/vuls/id/451380	US Government Resource
af854a3a-2127-422b-91ae-364da2661108	http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html
af854a3a-2127-422b-91ae-364da2661108	http://www.redhat.com/support/errata/RHSA-2006-0674.html
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/445825/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/19980
af854a3a-2127-422b-91ae-364da2661108	http://www.us-cert.gov/cas/techalerts/TA06-275A.html	US Government Resource
af854a3a-2127-422b-91ae-364da2661108	http://www.us-cert.gov/cas/techalerts/TA06-318A.html	US Government Resource
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2006/3573
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2006/3577
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2006/3852
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2006/4507
af854a3a-2127-422b-91ae-364da2661108	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/28886
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394

Impacted products

Vendor	Product	Version
adobe	flash_player	*
adobe	flash_player	8
adobe	flash_player	mx_2004
adobe	flex_sdk	1.5

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D18545D-9EE5-4AC5-9A44-0C548AFA691A",
              "versionEndIncluding": "8.0.24.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:8:*:pro:*:*:*:*:*",
              "matchCriteriaId": "9D344A18-4D7B-4B9C-8A8D-AE765FCA32C2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:flash_player:mx_2004:*:*:*:*:*:*:*",
              "matchCriteriaId": "33446303-71A3-4676-8D1D-E1E6EEF46BA9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:adobe:flex_sdk:1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "BF76C783-F118-4421-97D9-836172CE812A",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie."
    },
    {
      "lang": "es",
      "value": "Desbordamiento de b\u00fafer en Adobe Flash Player 8.0.24.0 y anteriores, Flash Professional 8, Flash MX 2004, y Flex 1.5 permite a un atacante con la complicidad del usuario ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una cadena grande y creada dinamicamente en una pel\u00edcula SWF."
    }
  ],
  "id": "CVE-2006-3311",
  "lastModified": "2026-06-16T22:26:49.097",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.1,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 4.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": true,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2006-09-12T23:07:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21865"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/21901"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/22054"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/22187"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/22268"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/22882"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/1546"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securitytracker.com/id?1016829"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/451380"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/19980"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/3573"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/3577"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/3852"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2006/4507"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21865"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/21901"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/22054"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/22187"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/22268"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/22882"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/1546"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1016829"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/451380"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/19980"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/3573"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/3577"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/3852"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2006/4507"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-GVVR-V2C3-C74R

Vulnerability from github – Published: 2022-05-01 07:07 – Updated: 2022-05-01 07:07

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2006-3311"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-09-12T23:07:00Z",
    "severity": "MODERATE"
  },
  "details": "Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.",
  "id": "GHSA-gvvr-v2c3-c74r",
  "modified": "2022-05-01T07:07:55Z",
  "published": "2022-05-01T07:07:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-3311"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/21865"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/21901"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22054"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22187"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22268"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/22882"
    },
    {
      "type": "WEB",
      "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/1546"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1016829"
    },
    {
      "type": "WEB",
      "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
    },
    {
      "type": "WEB",
      "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/451380"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/19980"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/3573"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/3577"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/3852"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/4507"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2006-3311

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2006-3311

Aliases

CVE-2006-3311

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2006-3311",
    "description": "Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.",
    "id": "GSD-2006-3311",
    "references": [
      "https://www.suse.com/security/cve/CVE-2006-3311.html",
      "https://access.redhat.com/errata/RHSA-2006:0674"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2006-3311"
      ],
      "details": "Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie.",
      "id": "GSD-2006-3311",
      "modified": "2023-12-13T01:19:57.745012Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2006-3311",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "ADV-2006-3573",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2006/3573"
          },
          {
            "name": "22054",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/22054"
          },
          {
            "name": "TA06-318A",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
          },
          {
            "name": "22268",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/22268"
          },
          {
            "name": "ADV-2006-4507",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2006/4507"
          },
          {
            "name": "VU#451380",
            "refsource": "CERT-VN",
            "url": "http://www.kb.cert.org/vuls/id/451380"
          },
          {
            "name": "19980",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/19980"
          },
          {
            "name": "http://www.computerterrorism.com/research/ct12-09-2006.htm",
            "refsource": "MISC",
            "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
          },
          {
            "name": "22187",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/22187"
          },
          {
            "name": "ADV-2006-3852",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2006/3852"
          },
          {
            "name": "22882",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/22882"
          },
          {
            "name": "21865",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/21865"
          },
          {
            "name": "flashplayer-swf-string-bo(28886)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
          },
          {
            "name": "APPLE-SA-2006-09-29",
            "refsource": "APPLE",
            "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
          },
          {
            "name": "oval:org.mitre.oval:def:394",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
          },
          {
            "name": "1546",
            "refsource": "SREASON",
            "url": "http://securityreason.com/securityalert/1546"
          },
          {
            "name": "20060912 Computer Terrorism (UK) :: Incident Response Centre - Adobe/Macromedia Flash Player Vulnerability",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
          },
          {
            "name": "SUSE-SA:2006:053",
            "refsource": "SUSE",
            "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
          },
          {
            "name": "1016829",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1016829"
          },
          {
            "name": "21901",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/21901"
          },
          {
            "name": "http://www.adobe.com/support/security/bulletins/apsb06-11.html",
            "refsource": "CONFIRM",
            "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
          },
          {
            "name": "RHSA-2006:0674",
            "refsource": "REDHAT",
            "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
          },
          {
            "name": "ADV-2006-3577",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2006/3577"
          },
          {
            "name": "TA06-275A",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
          },
          {
            "name": "MS06-069",
            "refsource": "MS",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
          },
          {
            "name": "GLSA-200610-02",
            "refsource": "GENTOO",
            "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:adobe:flash_player:mx_2004:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:adobe:flex_sdk:1.5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:adobe:flash_player:8:*:pro:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "8.0.24.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-3311"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Buffer overflow in Adobe Flash Player 8.0.24.0 and earlier, Flash Professional 8, Flash MX 2004, and Flex 1.5 allows user-assisted remote attackers to execute arbitrary code via a long, dynamically created string in a SWF movie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.computerterrorism.com/research/ct12-09-2006.htm",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.computerterrorism.com/research/ct12-09-2006.htm"
            },
            {
              "name": "http://www.adobe.com/support/security/bulletins/apsb06-11.html",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://www.adobe.com/support/security/bulletins/apsb06-11.html"
            },
            {
              "name": "21865",
              "refsource": "SECUNIA",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/21865"
            },
            {
              "name": "RHSA-2006:0674",
              "refsource": "REDHAT",
              "tags": [],
              "url": "http://www.redhat.com/support/errata/RHSA-2006-0674.html"
            },
            {
              "name": "19980",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/19980"
            },
            {
              "name": "1016829",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://securitytracker.com/id?1016829"
            },
            {
              "name": "21901",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/21901"
            },
            {
              "name": "VU#451380",
              "refsource": "CERT-VN",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.kb.cert.org/vuls/id/451380"
            },
            {
              "name": "SUSE-SA:2006:053",
              "refsource": "SUSE",
              "tags": [],
              "url": "http://www.novell.com/linux/security/advisories/2006_53_flashplayer.html"
            },
            {
              "name": "22054",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/22054"
            },
            {
              "name": "APPLE-SA-2006-09-29",
              "refsource": "APPLE",
              "tags": [],
              "url": "http://lists.apple.com/archives/security-announce/2006/Sep/msg00002.html"
            },
            {
              "name": "TA06-275A",
              "refsource": "CERT",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA06-275A.html"
            },
            {
              "name": "22187",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/22187"
            },
            {
              "name": "GLSA-200610-02",
              "refsource": "GENTOO",
              "tags": [],
              "url": "http://security.gentoo.org/glsa/glsa-200610-02.xml"
            },
            {
              "name": "22882",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/22882"
            },
            {
              "name": "TA06-318A",
              "refsource": "CERT",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA06-318A.html"
            },
            {
              "name": "22268",
              "refsource": "SECUNIA",
              "tags": [],
              "url": "http://secunia.com/advisories/22268"
            },
            {
              "name": "1546",
              "refsource": "SREASON",
              "tags": [],
              "url": "http://securityreason.com/securityalert/1546"
            },
            {
              "name": "ADV-2006-4507",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2006/4507"
            },
            {
              "name": "ADV-2006-3577",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2006/3577"
            },
            {
              "name": "ADV-2006-3573",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2006/3573"
            },
            {
              "name": "ADV-2006-3852",
              "refsource": "VUPEN",
              "tags": [],
              "url": "http://www.vupen.com/english/advisories/2006/3852"
            },
            {
              "name": "flashplayer-swf-string-bo(28886)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28886"
            },
            {
              "name": "oval:org.mitre.oval:def:394",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A394"
            },
            {
              "name": "MS06-069",
              "refsource": "MS",
              "tags": [],
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069"
            },
            {
              "name": "20060912 Computer Terrorism (UK) :: Incident Response Centre - Adobe/Macromedia Flash Player Vulnerability",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/445825/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 4.9,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": true,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2018-10-18T16:46Z",
      "publishedDate": "2006-09-12T23:07Z"
    }
  }
}

RHSA-2006:0674

Vulnerability from csaf_redhat - Published: 2006-09-12 18:52 - Updated: 2026-06-28 12:14

Summary

Red Hat Security Advisory: flash-plugin security update

Severity

Critical

Scope

4 vulnerabilities in this advisory, including CVE-2006-3311.

CVE-2006-3311

Fixed: 2 products

https://access.redhat.com/errata/RHSA-2006:0674

Open the full advisory

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2006-3311 (GCVE-0-2006-3311)

CERTA-2006-AVI-398

Description

Solution

CERTA-2006-AVI-416

Description

Solution

CERTA-2006-AVI-498

Description

Solution

FKIE_CVE-2006-3311

GHSA-GVVR-V2C3-C74R

GSD-2006-3311

RHSA-2006:0674

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour