CVE-2017-3073

Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.

Published: May 9, 2017
Updated: May 9, 2024
CVE: CVE-2017-3073
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: High
Score: 9.3
AV:N/AC:M/Au:N/C:C/I:C/A:C

CWEs:

CWE-416

Affected Software
References

Software	From	Fixed in
adobe / flash_player_desktop_runtime	-	25.0.0.163.x
adobe / flash_player	-	25.0.0.148.x
adobe / flash_player_desktop_runtime	-	25.0.0.148.x
redhat / enterprise_linux	6.0	6.0.x
redhat / enterprise_linux_desktop	6.0	6.0.x
redhat / enterprise_linux_workstation	6.0	6.0.x

http://www.securityfocus.com/bid/98349
http://www.securitytracker.com/id/1038427
https://access.redhat.com/errata/RHSA-2017:1219
https://helpx.adobe.com/security/products/flash-player/apsb17-15.html
https://security.gentoo.org/glsa/201705-12

Vulnerability Database

289,697

CVE-2017-3073