CVE-2017-3085

CWE-601 — Open RedirectCWE-200 — Information Exposure6 documents6 sources
Severity
7.4HIGH
EPSS
0.8%
top 25.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Adobe Flash PlayerAdobe Flash Player Desktop RuntimeAdobe Systems Incorporated Flash Player+3 more
Timeline
PublishedAug 11
Latest updateMay 13

Description

Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:NExploitability: 2.8 | Impact: 4.0

Affected Packages6 packages

▶NVDadobe/flash_player26.0.0.137
▶CVEListV5adobe_systems_incorporated/flash_player26.0.0.137 and earlier.
▶Ubuntuflashplugin-nonfree< 26.0.0.151ubuntu0.14.04.1+1

Also affects: Enterprise Linux 6.0

Patches

Patch: helpx.adobe.com ↗Patch: helpx.adobe.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-p58g-v8g4-qrc3: Adobe Flash Player versions 26↗2022-05-13
▶
CVEList
CVE-2017-3085: Adobe Flash Player versions 26↗2017-08-11
▶
OSV
CVE-2017-3085: Adobe Flash Player versions 26↗2017-08-11
▶

📋Vendor Advisories

1
Red Hat
flash-plugin: Information Disclosure via Security Bypass issue fixed in APSB17-23↗2017-08-08
▶

💬Community

1
Bugzilla
CVE-2017-3085 flash-plugin: Information Disclosure via Security Bypass issue fixed in APSB17-23↗2017-08-09
▶
CVE-2017-3085 (HIGH CVSS 7.4) | Adobe Flash Player versions 26.0.0. | cvebase.io