CVE-2017-2993 — HIGH (8.8) — White Hats Nepal

Q: What is CVE-2017-2993?

CVE-2017-2993 is a vulnerability with a CVSS score of 8.8 (HIGH). Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability related to event handlers. Successful exploitation could lead to arbitrary code execution.

Q: How severe is CVE-2017-2993?

CVE-2017-2993 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2017-2993?

Check the references section above for vendor advisories and patch information. Affected products include: Adobe Flash Player, Apple Mac Os X, Google Chrome Os, Linux Linux Kernel, Microsoft Windows.

Vulnerability Description

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability related to event handlers. Successful exploitation could lead to arbitrary code execution.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Adobe	Flash Player	<= 24.0.0.194
Apple	Mac Os X	-
Google	Chrome Os	-
Linux	Linux Kernel	-
Microsoft	Windows	-
Microsoft	Windows 10	-
Microsoft	Windows 8.1	-
Adobe	Flash Player Desktop Runtime	<= 24.0.0.194

Related Weaknesses (CWE)

CWE-416

References

http://rhn.redhat.com/errata/RHSA-2017-0275.htmlThird Party Advisory
http://www.securityfocus.com/bid/96199Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037815Broken LinkThird Party AdvisoryVDB Entry
https://helpx.adobe.com/security/products/flash-player/apsb17-04.htmlPatchVendor Advisory
https://security.gentoo.org/glsa/201702-20Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0275.htmlThird Party Advisory
http://www.securityfocus.com/bid/96199Broken LinkThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037815Broken LinkThird Party AdvisoryVDB Entry
https://helpx.adobe.com/security/products/flash-player/apsb17-04.htmlPatchVendor Advisory
https://security.gentoo.org/glsa/201702-20Third Party Advisory

FAQ

What is CVE-2017-2993?

CVE-2017-2993 is a vulnerability with a CVSS score of 8.8 (HIGH). Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability related to event handlers. Successful exploitation could lead to arbitrary code execution.

How severe is CVE-2017-2993?

CVE-2017-2993 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-2993?

Check the references section above for vendor advisories and patch information. Affected products include: Adobe Flash Player, Apple Mac Os X, Google Chrome Os, Linux Linux Kernel, Microsoft Windows.