8.8high
CVE-2017-11292KEVin critical feed
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be u…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.1 · CNA
CISA KEV
Yes
added 2022-03-03
EPSS
11.9%
percentile 96%
Public exploits
0
none known
Summary
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
Known exploited (CISA KEV)
- Added
- 4 y ago
- Due date
- 2022-03-24 (4 y ago)
- Ransomware use
- Unknown
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
- Vendor / product
- Adobe / Flash Player
- CISA name
- Adobe Flash Player Type Confusion Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction (EPSS)
11.88% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Affected products
- n/a Adobe Flash Player version 27.0.0.159 and earlier
Classification
- Weakness
- CWE-843 Access of Resource Using Incompatible Type
References
- securitytracker.com /id/1039582 · vdb-entry, x_refsource_SECTRACK, x_transferred
- helpx.adobe.com /security/products/flash-player/apsb17-32.html · x_refsource_CONFIRM, x_transferred
- security.gentoo.org /glsa/201710-22 · vendor-advisory, x_refsource_GENTOO, x_transferred
- securityfocus.com /bid/101286 · vdb-entry, x_refsource_BID, x_transferred
- access.redhat.com /errata/RHSA-2017:2899 · vendor-advisory, x_refsource_REDHAT, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 · government-resource
Sources
- CVE List: CVE-2017-11292
- NVD: CVE-2017-11292
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.