CVE-2017-11292
High · 8.8 CISA KEVCVSS
8.8
EPSS
11.9%
Published
Oct 22, 2017
CISA due date
Mar 24, 2022
The record
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:5 | flash-player-plugin | 0 | 27.0.0.170-1.mga5.nonfree |
| Mageia:6 | flash-player-plugin | 0 | 27.0.0.170-1.mga6.nonfree |
| Red Hat:rhel_extras:6 | flash-plugin | 0 | 0:27.0.0.170-1.el6_9 |
| Ubuntu:14.04:LTS | flashplugin-nonfree | 0 | 27.0.0.170ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | flashplugin-nonfree | 0 | 27.0.0.170ubuntu0.16.04.1 |
Related vulnerabilities
- CVE-2017-11281 Adobe Flash Player has an exploitable memory corruption vulnerability in the text… Also affects flash-player-plugin
- CVE-2017-11282 Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom… Also affects flash-player-plugin
- CVE-2017-3106 Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion… Also affects flash-player-plugin
- CVE-2017-3077 Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption… Also affects flash-player-plugin
- CVE-2017-3076 Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption… Also affects flash-player-plugin
- CVE-2017-3083 Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free… Also affects flash-player-plugin
- CVE-2017-3082 Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption… Also affects flash-player-plugin
- CVE-2017-3078 Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption… Also affects flash-player-plugin