CVE-2017-11292

HIGHCISA KEV

8.8

Descricao

Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

Detalhes CVE

Pontuacao CVSS v3.18.8

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado10/22/2017

Ultima modificacao4/22/2026

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorAdobe

ProdutoFlash Player

Nome da vulnerabilidadeAdobe Flash Player Type Confusion Vulnerability

Data inclusao KEV2022-03-03

Prazo de remediacao2022-03-24

Uso em ransomwareUnknown

Produtos afetados

adobe:flash_playeradobe:flash_player_desktop_runtimeapple:mac_os_xgoogle:chrome_oslinux:linux_kernelmicrosoft:windowsmicrosoft:windows_10microsoft:windows_8.1redhat:enterprise_linux_desktopredhat:enterprise_linux_serverredhat:enterprise_linux_workstation

Fraquezas (CWE)

CWE-843CWE-843

Referencias

http://www.securityfocus.com/bid/101286(psirt@adobe.com)

http://www.securitytracker.com/id/1039582(psirt@adobe.com)

https://access.redhat.com/errata/RHSA-2017:2899(psirt@adobe.com)

https://helpx.adobe.com/security/products/flash-player/apsb17-32.html(psirt@adobe.com)

https://security.gentoo.org/glsa/201710-22(psirt@adobe.com)

http://www.securityfocus.com/bid/101286(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1039582(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2017:2899(af854a3a-2127-422b-91ae-364da2661108)

https://helpx.adobe.com/security/products/flash-player/apsb17-32.html(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/201710-22(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.