Veille CVE
CVE-2017-11292
8.8 Élevée Exploitée activementCatalogue CISA KEV — Adobe Flash Player Type Confusion Vulnerability
Ajoutée le 03/03/2022 · Échéance de correction (agences US) : 24/03/2022
Action requise : The impacted product is end-of-life and should be disconnected if still in use.
Description
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 8.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 8.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 2.0 | 6.0 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- http://www.securityfocus.com/bid/101286 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039582 Broken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:2899 Third Party Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb17-32.html PatchVendor Advisory
- https://security.gentoo.org/glsa/201710-22 Third Party Advisory
- http://www.securityfocus.com/bid/101286 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039582 Broken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:2899 Third Party Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb17-32.html PatchVendor Advisory
- https://security.gentoo.org/glsa/201710-22 Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 US Government Resource