CVE-2017-2926
published 2017-01-11CVE-2017-2926: Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful…
PriorityP348high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
9.90%
95.1th percentile
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | flash_player | <= 24.0.0.186 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
flash-plugin: multiple code execution issues fixed in APSB17-02
vendor_redhat·2017-01-10·CVSS 8.8
CVE-2017-2926 [HIGH] flash-plugin: multiple code execution issues fixed in APSB17-02
flash-plugin: multiple code execution issues fixed in APSB17-02
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.
Package: flash-plugin (Red Hat Enterprise Linux 5) - Will not fix
GHSA
GHSA-c49x-6jw2-jchg: Adobe Flash Player versions 24
ghsa_unreviewed·2022-05-14
CVE-2017-2926 [CRITICAL] CWE-119 GHSA-c49x-6jw2-jchg: Adobe Flash Player versions 24
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.
OSV
CVE-2017-2926: Adobe Flash Player versions 24
osv·2017-01-11·CVSS 8.8
CVE-2017-2926 [HIGH] CVE-2017-2926: Adobe Flash Player versions 24
Adobe Flash Player versions 24.0.0.186 and earlier have an exploitable memory corruption vulnerability related to processing of atoms in MP4 files. Successful exploitation could lead to arbitrary code execution.
No detection rules found.
No public exploits indexed.
Fortinet
Fortinet Security Researcher Discovers Two Critical Vulnerabilities in Adobe Flash Player
blogs_fortinet·2017-01-17·CVSS 8.8
CVE-2017-2926 [HIGH] Fortinet Security Researcher Discovers Two Critical Vulnerabilities in Adobe Flash Player
FORTIGUARD LABS THREAT RESEARCH
Fortinet Security Researcher Discovers Two Critical Vulnerabilities in Adobe Flash Player
By Kai Lu | January 17, 2017
Fortinet security researcher Kai Lu discovered and reported two critical zero-day vulnerabilities in Adobe Flash Player in November 2016. Adobe identified them as CVE-2017-2926 and CVE-2017-2927 and released a patch to fix them on January 10, 2017. Here is a brief summary of each of these detected vulnerabilities.
CVE-2017-2926
This is a memory corruption vulnerability found in Flash Player’s engine when processing MP4 files. Specifically, the vulnerability is caused by a MP4 file with a crafted sample size in the MP4 atom specification that causes an out of bounds memory access, which sometimes triggers an access violation exception.
A
Bugzilla
CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 flash-plugin: mult
bugzilla·2017-01-10·CVSS 8.8
CVE-2017-2925 [HIGH] CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 flash-plugin: mult
CVE-2017-2925 CVE-2017-2926 CVE-2017-2927 CVE-2017-2928 CVE-2017-2930 CVE-2017-2931 CVE-2017-2932 CVE-2017-2933 CVE-2017-2934 CVE-2017-2935 CVE-2017-2936 CVE-2017-2937 CVE-2017-2938 flash-plugin: multiple code execution issues fixed in APSB17-02
Adobe Security Bulletin APSB17-02 for Adobe Flash Player describes multiple flaws that can possibly lead to code execution when Flash Player is used to play a specially crafted SWF file.
Quoting from the APSB17-02:
These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2017-2938).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2017-2932, CVE-2017-2936, CVE-2017-2937).
These updates resolve heap buffer overflow vulnerabilities that could lead to code exec
http://rhn.redhat.com/errata/RHSA-2017-0057.htmlhttp://www.securityfocus.com/bid/95350http://www.securitytracker.com/id/1037570https://helpx.adobe.com/security/products/flash-player/apsb17-02.htmlhttps://security.gentoo.org/glsa/201702-20http://rhn.redhat.com/errata/RHSA-2017-0057.htmlhttp://www.securityfocus.com/bid/95350http://www.securitytracker.com/id/1037570https://helpx.adobe.com/security/products/flash-player/apsb17-02.htmlhttps://security.gentoo.org/glsa/201702-20
2017-01-11
Published