Information disclosure in Adobe Flash Player and Adobe Flash Player for Linux - CVE-2017-2938

Vulnerability identifier: #VU4088

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-2938

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive data.

The vulnerability exists due to unknown error when handling .swf files. A remote attacker can create a specially crafted web page, trick the victim into visiting it and obtain potentially sensitive information.

Adobe Flash Player
Adobe Flash Player for Linux
Gentoo Linux
Arch Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Microsoft Windows
Windows Server

Install the latest version of Adobe Flash Player 24.0.0.194.

• https://helpx.adobe.com/security/products/flash-player/apsb17-02.html

• Multiple vulnerabilities in Adobe Flash Player
• Gentoo update for Adobe Flash Player
• Arch Linux update for lib32-flashplugin
• Arch Linux update for flashplugin
• SUSE Linux update for flash-player
• OpenSUSE Linux update for flash-player
• Red Hat update for flash-plugin