CVE-2007-5275
adobe shockwave player: no CVSS score yet. EPSS 6.2% chance of exploitation in the next 30 days.
The Adobe Macromedia Flash 9 plug-in allows remote attackers to cause a victim machine to establish TCP sessions with arbitrary hosts via a Flash (SWF) movie, related to lack of pinning of a hostname to a single IP address after receiving an allow-access-from element in a cross-domain-policy XML document, and the availability of a Flash Socket class that does not use the browser's DNS pins, aka DNS rebinding attacks, a different issue than CVE-2002-1467 and CVE-2007-4324.
- EPSS
- 6.2% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- adobe:shockwave_player
References
- http://crypto.stanford.edu/dns/dns-rebinding.pdf
- http://lists.apple.com/archives/security-announce/2008//May/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2007-12/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2008-04/msg00006.html
- http://secunia.com/advisories/28157