CVE-2017-3084 - Vulnerability Details - OpenCVE

Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the advertising metadata functionality. Successful exploitation could lead to arbitrary code execution.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Adobe	Flash Player
Redhat	Rhel Extras

Configuration 1 [-]

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 6 Supplementary
flash-plugin-0:26.0.0.126-1.el6_9	cpe:/a:redhat:rhel_extras:6	RHSA-2017:1439	2017-06-13T00:00:00Z

References

Link	Providers
http://www.securityfocus.com/bid/99023
http://www.securitytracker.com/id/1038655
https://access.redhat.com/errata/RHSA-2017:1439
https://helpx.adobe.com/security/products/flash-player/apsb17-17.html
https://nvd.nist.gov/vuln/detail/CVE-2017-3084
https://security.gentoo.org/glsa/201707-15
https://www.cve.org/CVERecord?id=CVE-2017-3084

History

No history.

MITRE

Status: PUBLISHED

Assigner: adobe

Published: 2017-06-20T17:00:00

Updated: 2024-08-05T14:16:28.113Z

Reserved: 2016-12-02T00:00:00

Link: CVE-2017-3084

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-06-20T17:29:00.423

Modified: 2024-11-21T03:24:48.093

Link: CVE-2017-3084

Redhat

Severity : Critical

Publid Date: 2017-06-13T00:00:00Z

Links: CVE-2017-3084 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "Adobe Flash Player 25.0.0.171 and earlier.", "vendor": "n/a", "versions": [{"status": "affected", "version": "Adobe Flash Player 25.0.0.171 and earlier."}]}], "datePublic": "2017-06-20T00:00:00", "descriptions": [{"lang": "en", "value": "Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the advertising metadata functionality. Successful exploitation could lead to arbitrary code execution."}], "problemTypes": [{"descriptions": [{"description": "Use After Free", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-17.html"}, {"name": "99023", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99023"}, {"name": "1038655", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1038655"}, {"name": "RHSA-2017:1439", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:1439"}, {"name": "GLSA-201707-15", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201707-15"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@adobe.com", "ID": "CVE-2017-3084", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Adobe Flash Player 25.0.0.171 and earlier.", "version": {"version_data": [{"version_value": "Adobe Flash Player 25.0.0.171 and earlier."}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the advertising metadata functionality. Successful exploitation could lead to arbitrary code execution."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Use After Free"}]}]}, "references": {"reference_data": [{"name": "https://helpx.adobe.com/security/products/flash-player/apsb17-17.html", "refsource": "CONFIRM", "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-17.html"}, {"name": "99023", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99023"}, {"name": "1038655", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1038655"}, {"name": "RHSA-2017:1439", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:1439"}, {"name": "GLSA-201707-15", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201707-15"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T14:16:28.113Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-17.html"}, {"name": "99023", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99023"}, {"name": "1038655", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1038655"}, {"name": "RHSA-2017:1439", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:1439"}, {"name": "GLSA-201707-15", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201707-15"}]}]}, "cveMetadata": {"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "cveId": "CVE-2017-3084", "datePublished": "2017-06-20T17:00:00", "dateReserved": "2016-12-02T00:00:00", "dateUpdated": "2024-08-05T14:16:28.113Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*", "matchCriteriaId": "FE421134-FFEE-4027-8724-95D6FD108373", "versionEndIncluding": "25.0.0.171", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the advertising metadata functionality. Successful exploitation could lead to arbitrary code execution."}, {"lang": "es", "value": "Las versiones de Adobe Flash Player 25.0.0.171 y anteriores podr\u00edan permitir la explotaci\u00f3n de una vulnerabilidad en la funcionalidad publicitaria de los metadatos. Una explotaci\u00f3n exitosa podr\u00eda conducir a la ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2017-3084", "lastModified": "2024-11-21T03:24:48.093", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-06-20T17:29:00.423", "references": [{"source": "psirt@adobe.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99023"}, {"source": "psirt@adobe.com", "url": "http://www.securitytracker.com/id/1038655"}, {"source": "psirt@adobe.com", "url": "https://access.redhat.com/errata/RHSA-2017:1439"}, {"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-17.html"}, {"source": "psirt@adobe.com", "url": "https://security.gentoo.org/glsa/201707-15"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99023"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id/1038655"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2017:1439"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-17.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201707-15"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}