CVE-2017-11292

Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
References
Link Resource
http://www.securityfocus.com/bid/101286 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039582 Broken Link Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:2899 Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb17-32.html Patch Vendor Advisory
https://security.gentoo.org/glsa/201710-22 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*
OR cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

History

27 Jan 2023, 19:24

Type Values Removed Values Added
CPE cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer_11:*:*
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
References (SECTRACK) http://www.securitytracker.com/id/1039582 - Broken Link (SECTRACK) http://www.securitytracker.com/id/1039582 - Broken Link, Third Party Advisory, VDB Entry
References (BID) http://www.securityfocus.com/bid/101286 - Broken Link (BID) http://www.securityfocus.com/bid/101286 - Broken Link, Third Party Advisory, VDB Entry
References (CONFIRM) https://helpx.adobe.com/security/products/flash-player/apsb17-32.html - Issue Tracking, Vendor Advisory (CONFIRM) https://helpx.adobe.com/security/products/flash-player/apsb17-32.html - Patch, Vendor Advisory
CVSS v2 : 6.5
v3 : 8.8
v2 : 6.0
v3 : 8.8
First Time Adobe flash Player Desktop Runtime

18 Apr 2022, 17:55

Type Values Removed Values Added
CPE cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
References (BID) http://www.securityfocus.com/bid/101286 - Third Party Advisory, VDB Entry (BID) http://www.securityfocus.com/bid/101286 - Broken Link
References (REDHAT) https://access.redhat.com/errata/RHSA-2017:2899 - (REDHAT) https://access.redhat.com/errata/RHSA-2017:2899 - Third Party Advisory
References (SECTRACK) http://www.securitytracker.com/id/1039582 - Third Party Advisory, VDB Entry (SECTRACK) http://www.securitytracker.com/id/1039582 - Broken Link
CWE CWE-129 CWE-843
First Time Redhat enterprise Linux Server
Redhat enterprise Linux Workstation
Redhat enterprise Linux Desktop
Redhat

22 Sep 2021, 14:25

Type Values Removed Values Added
CPE cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Information

Published : 2017-10-22 19:29

Updated : 2023-12-10 12:15


NVD link : CVE-2017-11292

Mitre link : CVE-2017-11292

CVE.ORG link : CVE-2017-11292


JSON object : View

Products Affected

microsoft

  • windows_8.1
  • windows_10
  • windows

redhat

  • enterprise_linux_desktop
  • enterprise_linux_server
  • enterprise_linux_workstation

adobe

  • flash_player
  • flash_player_desktop_runtime

google

  • chrome_os

linux

  • linux_kernel

apple

  • mac_os_x
CWE
CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')