Vulnerability Description
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Flash Player Desktop Runtime | <= 27.0.0.159 |
| Apple | Mac Os X | - |
| Linux | Linux Kernel | - |
| Microsoft | Windows | - |
| Adobe | Flash Player | <= 27.0.0.130 |
| Microsoft | Windows 10 | - |
| Microsoft | Windows 8.1 | - |
| Chrome Os | - | |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Workstation | 6.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/101286Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039582Broken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:2899Third Party Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb17-32.htmlPatchVendor Advisory
- https://security.gentoo.org/glsa/201710-22Third Party Advisory
- http://www.securityfocus.com/bid/101286Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039582Broken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:2899Third Party Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb17-32.htmlPatchVendor Advisory
- https://security.gentoo.org/glsa/201710-22Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-US Government Resource
FAQ
What is CVE-2017-11292?
CVE-2017-11292 is a vulnerability with a CVSS score of 8.8 (HIGH). Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to ty...
How severe is CVE-2017-11292?
CVE-2017-11292 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-11292?
Check the references section above for vendor advisories and patch information. Affected products include: Adobe Flash Player Desktop Runtime, Apple Mac Os X, Linux Linux Kernel, Microsoft Windows, Adobe Flash Player.