CVE-2006-5330

Published: Oct 17, 2006Modified: Apr 23, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

CRLF injection vulnerability in Adobe Flash Player plugin 9.0.16 and earlier for Windows, 7.0.63 and earlier for Linux, 7.x before 7.0 r67 for Solaris, and before 9.0.28.0 for Mac OS X, allows remote attackers to modify HTTP headers of client requests and conduct HTTP Request Splitting attacks via CRLF sequences in arguments to the ActionScript functions (1) XML.addRequestHeader and (2) XML.contentType. NOTE: the flexibility of the attack varies depending on the type of web browser being used.

Affected (4)

Products: Adobe: Flash Player

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Adobe Flash Player	Up to 7.0.63
Adobe Flash Player	Up to 9.0.28.0
Adobe Flash Player	Up to 7.0_r67
Adobe Flash Player	Up to 9.0.16

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (48)

http://docs.info.apple.com/article.html?artnum=305214

Source: cve@mitre.org

http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html

Source: cve@mitre.org

http://lists.suse.com/archive/suse-security-announce/2006-Dec/0006.html

Source: cve@mitre.org

http://secunia.com/advisories/22467

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23324

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23581

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24479

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/25467

Source: cve@mitre.org

Vendor Advisory

http://securityreason.com/securityalert/1737

Source: cve@mitre.org

http://securitytracker.com/id?1017078

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102932-1

Source: cve@mitre.org

http://www.adobe.com/support/security/advisories/apsa06-01.html

Source: cve@mitre.org

http://www.adobe.com/support/security/bulletins/apsb06-18.html

Source: cve@mitre.org

http://www.osvdb.org/29863

Source: cve@mitre.org

http://www.rapid7.com/advisories/R7-0026.jsp

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0009.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/448997/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/20592

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA07-072A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2006/4094

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/0930

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/1999

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/29634

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11405

Source: cve@mitre.org

http://docs.info.apple.com/article.html?artnum=305214

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.apple.com/archives/security-announce/2007/Mar/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.suse.com/archive/suse-security-announce/2006-Dec/0006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/22467

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/23324

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/23581

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/24479

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/25467

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://securityreason.com/securityalert/1737

Source: af854a3a-2127-422b-91ae-364da2661108

http://securitytracker.com/id?1017078

Source: af854a3a-2127-422b-91ae-364da2661108

http://sunsolve.sun.com/search/document.do?assetkey=1-26-102932-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.adobe.com/support/security/advisories/apsa06-01.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.adobe.com/support/security/bulletins/apsb06-18.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/29863

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.rapid7.com/advisories/R7-0026.jsp

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2007-0009.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/448997/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/20592

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA07-072A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2006/4094

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2007/0930

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2007/1999

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/29634

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11405

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.