CVE-2007-2500

Published: 4 May 2007

server/parser/sprite_definition.cpp in GNU Gnash (aka GNU Flash Player) 0.7.2 allows remote attackers to execute arbitrary code via a large number of SHOWFRAME elements within a DEFINESPRITE element, which triggers memory corruption and enables the attacker to call free with an arbitrary address, probably resultant from a buffer overflow.

Priority

Status

Package	Release	Status
gnash Launchpad, Ubuntu, Debian	dapper	Does not exist
	edgy	Does not exist
	feisty	Released (0.7.2-1ubuntu0.1)
	gutsy	Released (0.7.2+cvs20070518.1557-1)
	upstream	Needs triage

References

https://www.cve.org/CVERecord?id=CVE-2007-2500
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.