CVE-2017-2994

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution.
References
Link Resource
http://rhn.redhat.com/errata/RHSA-2017-0526.html Third Party Advisory
http://www.securityfocus.com/bid/96199 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1037815 Broken Link Third Party Advisory VDB Entry
https://helpx.adobe.com/security/products/flash-player/apsb17-04.html Not Applicable Patch Vendor Advisory
https://security.gentoo.org/glsa/201702-20 Third Party Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*
OR cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

17 Nov 2022, 17:56

Type Values Removed Values Added
CPE cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*
CVSS v2 : 6.8
v3 : 8.8
v2 : 9.3
v3 : 8.8
First Time Adobe flash Player Desktop Runtime
References (BID) http://www.securityfocus.com/bid/96199 - (BID) http://www.securityfocus.com/bid/96199 - Broken Link, Third Party Advisory, VDB Entry
References (SECTRACK) http://www.securitytracker.com/id/1037815 - (SECTRACK) http://www.securitytracker.com/id/1037815 - Broken Link, Third Party Advisory, VDB Entry
References (GENTOO) https://security.gentoo.org/glsa/201702-20 - (GENTOO) https://security.gentoo.org/glsa/201702-20 - Third Party Advisory
References (CONFIRM) https://helpx.adobe.com/security/products/flash-player/apsb17-04.html - Vendor Advisory (CONFIRM) https://helpx.adobe.com/security/products/flash-player/apsb17-04.html - Not Applicable, Patch, Vendor Advisory
References (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0526.html - (REDHAT) http://rhn.redhat.com/errata/RHSA-2017-0526.html - Third Party Advisory

Information

Published : 2017-02-15 06:59

Updated : 2023-12-10 12:01


NVD link : CVE-2017-2994

Mitre link : CVE-2017-2994

CVE.ORG link : CVE-2017-2994


JSON object : View

Products Affected

microsoft

  • windows_10
  • windows
  • windows_8.1

adobe

  • flash_player
  • flash_player_desktop_runtime

apple

  • mac_os_x

linux

  • linux_kernel

google

  • chrome_os
CWE
CWE-416

Use After Free