Two vulnerabilities have been reported in ColdFusion, which can be exploited by malicious, local users to bypass certain security restrictions and by malicious people to cause a DoS (Denial of Service).

1) It is possible to cause an infinite loop in ColdFusion by sending a specially crafted command to the ColdFusion Flash Remoting Gateway.

2) An error exists due to CFML templates outside a sandbox being able to call ColdFusion components within a sandbox in certain situations.

The vulnerabilities have been reported in versions 7 and 7.0.1.

Solution
Update to version 7.0.2 or apply hotfixes for version 7.0.1:
Further details available in Customer Area

Provided and/or discovered by
The vendor credits:
1) Shigeyoshi Muraoka, IT Frontier Corporation
2) Stephen Moretti, Nil Desperandum

Original Advisory
Adobe Systems:
http://www.adobe.com/support/security/bulletins/apsb06-12.html
http://www.adobe.com/support/security/bulletins/apsb06-13.html

Deep Links
Links available in Customer Area