| Package | Affected versions | Patched versions |
|---|---|---|
| air | < 1.5 | 1.5 |
| flash player | ≥ 10, < 10.0.12.36≥ 9.0.16.0, < 9.0.151.0 | 10.0.12.369.0.151.0 |
The DefineConstantPool action in the ActionScript 2 virtual machine in Adobe Flash Player 10.x before 10.0.12.36 and 9.x before 9.0.151.0, and Adobe AIR before 1.5, accepts an untrusted input value for a "constant count," which allows remote attackers to read sensitive data from process memory via a crafted PDF file.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free