CVE-2017-3002 — Use After Free in Adobe Flash Player

CWE-416 — Use After Free5 documents5 sources
Severity
8.8HIGHNVD
EPSS
1.9%
top 16.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Adobe Flash PlayerAdobe Flash Player Desktop Runtime
Timeline
PublishedMar 14
Latest updateMay 14

Description

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability in the ActionScript2 TextField object related to the variable property. Successful exploitation could lead to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDadobe/flash_player24.0.0.221

Patches

Patch: helpx.adobe.com ↗Patch: helpx.adobe.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-27h4-gxf8-4gg7: Adobe Flash Player versions 24↗2022-05-14
▶
CVEList
CVE-2017-3002: Adobe Flash Player versions 24↗2017-03-14
▶

📋Vendor Advisories

1
Red Hat
flash-plugin: multiple code execution issues fixed in APSB17-07↗2017-03-14
▶

💬Community

1
Bugzilla
CVE-2017-2994 CVE-2017-2997 CVE-2017-2998 CVE-2017-2999 CVE-2017-3000 CVE-2017-3001 CVE-2017-3002 CVE-2017-3003 flash-plugin: multiple code execution issues fixed in APSB17-07↗2017-03-14
▶
CVE-2017-3002 — Use After Free in Adobe Flash Player | cvebase