Vulnerability Details : CVE-2017-3073
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.
Vulnerability category: Memory Corruption
Exploit prediction scoring system (EPSS) score for CVE-2017-3073
Probability of exploitation activity in the next 30 days: 1.03%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 82 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-3073
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2017-3073
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-3073
-
https://access.redhat.com/errata/RHSA-2017:1219
RHSA-2017:1219 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://security.gentoo.org/glsa/201705-12
Adobe Flash Player: Multiple vulnerabilities (GLSA 201705-12) — Gentoo securityThird Party Advisory
-
http://www.securityfocus.com/bid/98349
Adobe Flash Player APSB17-15 Multiple Memory Corruption VulnerabilitiesBroken Link;Third Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1038427
Adobe Flash Player Use-After-Free and Memory Corruption Errors Let Remote Users Execute Arbitrary Code - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
https://helpx.adobe.com/security/products/flash-player/apsb17-15.html
Adobe Security BulletinPatch;Vendor Advisory
Products affected by CVE-2017-3073
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*
- cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*