CVE-2007-2500

CRITICAL 10.0CVE-2007-2500 · Published 04/05/2007 · updated 16/06/2026

In short

CVE-2007-2500 is a CRITICAL (CVSS 10.0) vulnerability affecting flash player (gnu).
Chance of exploitation in the next 30 days (EPSS): 5.4%, higher than 92.7% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
flash player gnu	`≤ 0.7.2`	No fix yet

Description

server/parser/sprite_definition.cpp in GNU Gnash (aka GNU Flash Player) 0.7.2 allows remote attackers to execute arbitrary code via a large number of SHOWFRAME elements within a DEFINESPRITE element, which triggers memory corruption and enables the attacker to call free with an arbitrary address, probably resultant from a buffer overflow.

References

osvdb.org/37273
savannah.gnu.org/bugs
secunia.com/advisories/25787
novell.com/linux/security/advisories/2007_13_sr.html
securityfocus.com/bid/23765
securitytracker.com/id
vupen.com/english/advisories/2007/1688
exchange.xforce.ibmcloud.com/vulnerabilities/34148

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free