PT-2017-4162 · Adobe+2 · Flash Player+2

Published 2017-10-16 · Updated 2023-01-27 · CVE-2017-11292

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions 27.0.0.159 and earlier

Description The issue is related to a flawed bytecode verification procedure in Adobe Flash Player, which allows an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution. The vulnerability is associated with incorrect array data indexing, and its exploitation may allow a remote attacker to execute arbitrary code.

Recommendations For Adobe Flash Player versions 27.0.0.159 and earlier, update to a version that fixes the flawed bytecode verification procedure to prevent type confusion and arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Type Confusion

Weakness Enumeration

CWE-129

CWE-843

Related Identifiers

ALT-PU-2017-2537

ALT-PU-2018-2414

BDU:2021-05393

CVE-2017-11292

MGASA-2017-0377

RHSA-2017:2899

RHSA-2017_2899

Affected Products

Alt Linux

Flash Player

Red Hat

References · 19

• https://helpx.adobe.com/security/products/flash-player/apsb17-32.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0377.html · Security Note
• https://access.redhat.com/errata/RHSA-2017:2899 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-11292 · Vendor Advisory
• https://security.gentoo.org/glsa/201710-22 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-11292 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05393 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11292 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-11292 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-11292 · Security Note
• https://osv.dev/vulnerability/MGASA-2017-0377 · Vendor Advisory
• http://securityfocus.com/bid/101286 · Note
• https://bugs.mageia.org/show_bug.cgi?id=21883 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note