PT-2017-4162 · Adobe+2 · Flash Player+2

CVE-2017-11292 · Publicado 2017-10-16 · Atualizado 2023-01-27

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions 27.0.0.159 and earlier

Description The issue is related to a flawed bytecode verification procedure in Adobe Flash Player, which allows an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution. The vulnerability is associated with incorrect array data indexing, and its exploitation may allow a remote attacker to execute arbitrary code.

Recommendations For Adobe Flash Player versions 27.0.0.159 and earlier, update to a version that fixes the flawed bytecode verification procedure to prevent type confusion and arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Type Confusion

Enumeração de Fraquezas

CWE-129

CWE-843

Identificadores relacionados

ALT-PU-2017-2537

ALT-PU-2018-2414

BDU:2021-05393

CVE-2017-11292

MGASA-2017-0377

RHSA-2017:2899

RHSA-2017_2899

Produtos afetados

Alt Linux

Flash Player

Red Hat

Referências · 19

• http://securityfocus.com/bid/101286 · Nota
• https://helpx.adobe.com/security/products/flash-player/apsb17-32.html · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=21883 · Nota
• https://advisories.mageia.org/MGASA-2017-0377.html · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2017:2899 · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 · Nota
• https://ubuntu.com/security/CVE-2017-11292 · Aviso do Fabricante
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Nota
• https://t.me/cvenotify/21268 · Publicação no Telegram
• https://security.gentoo.org/glsa/201710-22 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-11292 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2021-05393 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11292 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2017-11292 · Nota
• https://cve.org/CVERecord?id=CVE-2017-11292 · Nota de Segurança