CVE-2017-11282: adobe flash_player

CVSS: 9.8v3.0CriticalModified

AliasesUBUNTU-CVE-2017-11282

Published 01-12-2017Last modified 05-08-2024

Vulnerability summary

CVE-2017-11282 is a critical (CVSS 9.8) vulnerability in adobe flash_player. EPSS estimates a 34.05% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

34.05%

0%100%

High · -0.80 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 2

MGASA-2017-0339 RHSA-2017:2702

Timeline

01-12-2017
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

34.05%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

-0.80 pp

From 34.85% on 18-09-2026

18-09-202618-10-2026

EPSS score

34.05%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (youtube.com)
Maturity: unknown
exploit-databasedosmultipleVerified
Adobe Flash - Out-of-Bounds Read in applyToRange
Maturity: poc

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Redhat3 products

Adobe1 product

flash_player≤ 26.0.0.151

Ubuntu1 product

flashplugin-nonfree< 27.0.0.130ubuntu0.14.04.1 | < 27.0.0.130ubuntu0.16.04.1

3 vendors · 5 products

References

12 links

packetstormsecurity.com/files/144332/Adobe-Flash-appleToRange-Out-Of-Bounds-Read.htmlX Refsource MISCThird Party AdvisoryVDB Entry
bugs.chromium.org/p/project-zero/issues/detail?id=1323X Refsource MISCThird Party Advisory
www.securityfocus.com/bid/100716VDB EntryX Refsource BIDThird Party Advisory
www.youtube.com/watch?v=6iZnIQbRf5MX Refsource MISCExploitThird Party Advisory
security.gentoo.org/glsa/201709-16Vendor AdvisoryX Refsource GENTOOThird Party AdvisoryVDB Entry
www.exploit-db.com/exploits/42783/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
helpx.adobe.com/security/products/flash-player/apsb17-28.htmlX Refsource CONFIRMVendor Advisory
access.redhat.com/errata/RHSA-2017:2702Vendor AdvisoryX Refsource REDHATThird Party Advisory
www.securitytracker.com/id/1039314VDB EntryX Refsource SECTRACKThird Party Advisory
ubuntu.com/security/CVE-2017-11282REPORT

Show all 12 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities