PT-2017-3413 · Adobe+2 · Flash Player+2

Published 2017-11-14 · Updated 2021-09-08 · CVE-2017-3112

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions 27.0.0.183 and earlier

Description The issue occurs due to a computation that reads data past the end of the target buffer, specifically in the AdobePSDK metadata. This happens because of an invalid pointer offset used during access of internal data structure fields. A successful attack can lead to sensitive data exposure. The vulnerability can also allow a remote attacker to execute arbitrary code.

Recommendations For Adobe Flash Player versions 27.0.0.183 and earlier, update to a version later than 27.0.0.183 to resolve the issue. As a temporary workaround, consider restricting access to AdobePSDK metadata until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2017-2836

ALT-PU-2018-2414

BDU:2018-00201

CVE-2017-3112

MGASA-2017-0410

RHSA-2017:3222

RHSA-2017_3222

ZDI-17-996

Affected Products

Alt Linux

Flash Player

Red Hat

References · 15

• https://bdu.fstec.ru/vul/2018-00201 · Security Note
• https://helpx.adobe.com/security/products/flash-player/apsb17-33.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-3112 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-996 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3112 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:3222 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-3112 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3112 · Security Note
• https://security.gentoo.org/glsa/201711-13 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-3112 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0410 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0410.html · Security Note
• http://securitytracker.com/id/1039778 · Note
• http://securityfocus.com/bid/101837 · Note
• https://bugs.mageia.org/show_bug.cgi?id=22023 · Note