CVE
- Id
- 4869
- CVE No.
- CVE-2002-0477
- Status
- Candidate
- Description
- Standalone Macromedia Flash Player 5.0 before 5,0,30,2 allows remote attackers to execute arbitrary programs via a .SWF file containing the "exec" FSCommand.
- Phase
- Proposed (20020611)
- Votes
- ACCEPT(5) Baker, Cole, Frech, Green, Wall | NOOP(2) Cox, Foat | REVIEWING(1) Christey
- Comments
- Christey> Is swf_clear.html *really* related to standalone_update.htm? | Or is the former really talking about a third issue related to | a virus? standalone_update.htm is clearly fscommand ("exec"). | It has an "Additional information" statement that says: | "For a description of the potential issue with the previous | stand-alone player, please refer to [swf_clear.htm]" | | I interpret "the previous stand-alone player" as meaning "the player | that we are updating with this advisory." Since we know that | standalone_update.htm is exec, this implies that swf_clear.htm is | really the exec issue. However, swf_clear.html doesn"t | mention fscommand ("exec") AT ALL, which casts doubt or at | least uncertainty as to my conclusions. | | swf_clear.html links back to standalone_update.htm, so at | least the references are circular. | | At least it"s pretty clear that this issue is different from | CVE-2002-0476. | | Email inquiry sent to Macromedia on June 13, 2002.
