Vulnerability Details : CVE-2017-11282
Potential exploit
Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.
Vulnerability category: OverflowMemory Corruption
Products affected by CVE-2017-11282
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*
- cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-11282
5.50%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 93 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-11282
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2017-11282
-
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-11282
-
https://security.gentoo.org/glsa/201709-16
Adobe Flash Player: Multiple vulnerabilities (GLSA 201709-16) — Gentoo securityThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1039314
Adobe Flash Player Memory Corruption Bugs Let Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
https://www.exploit-db.com/exploits/42783/
Adobe Flash - Out-of-Bounds Read in applyToRangeExploit;Third Party Advisory;VDB Entry
-
https://bugs.chromium.org/p/project-zero/issues/detail?id=1323
1323 - Adobe Flash: Out-of-bounds read in applyToRange - project-zero - MonorailThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:2702
RHSA-2017:2702 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://www.youtube.com/watch?v=6iZnIQbRf5M
0patching Flash Player Remote Memory Corruption (CVE-2017-11282) - YouTubeExploit;Third Party Advisory
-
http://www.securityfocus.com/bid/100716
Adobe Flash Player CVE-2017-11282 Remote Memory Corruption VulnerabilityThird Party Advisory;VDB Entry
-
https://helpx.adobe.com/security/products/flash-player/apsb17-28.html
Adobe Security BulletinVendor Advisory
-
http://packetstormsecurity.com/files/144332/Adobe-Flash-appleToRange-Out-Of-Bounds-Read.html
Adobe Flash appleToRange Out-Of-Bounds Read ≈ Packet StormThird Party Advisory;VDB Entry
Jump to