CVE-2017-2994 — Use After Free in Adobe Flash Player

CWE-416 — Use After Free6 documents6 sources
Severity
8.8HIGHNVD
EPSS
2.9%
top 13.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Adobe Flash PlayerAdobe Flash Player Desktop Runtime
Timeline
PublishedFeb 15
Latest updateMay 14

Description

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in Primetime SDK event dispatch. Successful exploitation could lead to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDadobe/flash_player24.0.0.221

Patches

Patch: helpx.adobe.com ↗Patch: helpx.adobe.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-qjg3-fxfr-j85c: Adobe Flash Player versions 24↗2022-05-14
▶
OSV
CVE-2017-2994: Adobe Flash Player versions 24↗2017-02-15
▶
CVEList
CVE-2017-2994: Adobe Flash Player versions 24↗2017-02-15
▶

📋Vendor Advisories

1
Red Hat
flash-plugin: multiple code execution issues fixed in APSB17-07↗2017-03-14
▶

💬Community

1
Bugzilla
CVE-2017-2994 CVE-2017-2997 CVE-2017-2998 CVE-2017-2999 CVE-2017-3000 CVE-2017-3001 CVE-2017-3002 CVE-2017-3003 flash-plugin: multiple code execution issues fixed in APSB17-07↗2017-03-14
▶
CVE-2017-2994 — Use After Free in Adobe Flash Player | cvebase