CVE-2007-6245 json
Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for client…
published 2007-12-20 18 y ago modified 2026-06-16 4 mo ago also EUVD-2007-6213
- cvss
- 5.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 4.7%
- EPSS 4.7% chance of exploitation in 30 days, percentile 91%
- public exploits
- 0
- none known
Summary
Adobe Flash Player 9.x up to 9.0.48.0, 8.x up to 8.0.35.0, and 7.x up to 7.0.70.0 allows remote attackers to modify HTTP headers for client requests and conduct HTTP Request Splitting attacks.
Patch / fix
- flash-plugin RHEL 3 EXTRAS 9.0.115.0-1.el3.with.oss
- flash-plugin RHEL 4 EXTRAS 9.0.115.0-1.el4
- flash-plugin RHEL 5 EXTRAS 9.0.115.0-1.el5
red hat advisories RHSA-2007:1126
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2007-6245 updated
flash: HTTP headers modification
-
Red Hat Desktop version 3 Extras flash-plugin 9.0.115.0-1.el3.with.oss Red Hat Desktop version 4 Extras flash-plugin 9.0.115.0-1.el4 Red Hat Enterprise Linux AS version 3 Extras flash-plugin 9.0.115.0-1.el3.with.oss Red Hat Enterprise Linux AS version 4 Extras flash-plugin 9.0.115.0-1.el4 Red Hat Enterprise Linux Desktop Supplementary (v. 5) flash-plugin 9.0.115.0-1.el5 Red Hat Enterprise Linux ES version 3 Extras flash-plugin 9.0.115.0-1.el3.with.ossfixed: vendor fix RHSA-2007:1126
+4 more productsfewer
Red Hat Enterprise Linux ES version 4 Extras flash-plugin 9.0.115.0-1.el4 Red Hat Enterprise Linux Server Supplementary (v. 5) flash-plugin 9.0.115.0-1.el5 Red Hat Enterprise Linux WS version 3 Extras flash-plugin 9.0.115.0-1.el3.with.oss Red Hat Enterprise Linux WS version 4 Extras flash-plugin 9.0.115.0-1.el4
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
4.71% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
lists.opensuse.org
/opensuse-security-announce/2007-12/msg00007.html
vendor-advisory
-
gentoo.org
/security/en/glsa/glsa-200801-07.xml
vendor-advisory
-
redhat.com
/support/errata/RHSA-2007-1126.html
vendor-advisory
-
sunsolve.sun.com
/search/document.do?assetkey=1-26-238305-1
vendor-advisory
-
secunia.com
/advisories/28157
third-party-advisory
-
secunia.com
/advisories/30507
third-party-advisory
-
secunia.com
/advisories/28570
third-party-advisory
-
vupen.com
/english/advisories/2008/1724/references
vdb-entry
-
us-cert.gov
/cas/techalerts/TA07-355A.html
third-party-advisory, us-government-resource
-
securityfocus.com
/bid/26929
vdb-entry
-
secunia.com
/advisories/28161
third-party-advisory
-
vupen.com
/english/advisories/2007/4258
vdb-entry
-
securitytracker.com
/id?1019116
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9546
vdb-entry, signature
-
exchange.xforce.ibmcloud.com
/vulnerabilities/39134
vdb-entry
-
securityfocus.com
/bid/26969
vdb-entry
-
secunia.com
/advisories/28213
third-party-advisory
- adobe.com /support/security/bulletins/apsb07-20.html
Sources
- CVE List CVE-2007-6245
- NVD CVE-2007-6245
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.