Main Vulnerability Database Vulnerabilities #VU4089

Use-after-free error in Adobe Flash Player and Adobe Flash Player for Linux - CVE-2017-2932

Published: January 10, 2017 / Updated: March 16, 2017

Vulnerability identifier: #VU4089

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-2932

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allow a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted. swf file, trick the victim into opening it, cause memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Adobe Flash Player
Adobe Flash Player for Linux
Gentoo Linux
Arch Linux
Windows RT
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Microsoft Windows
Windows Server

How to mitigate CVE-2017-2932

Install the latest version of Adobe Flash Player 24.0.0.194.

Links to Public Exploits and PoC-codes

Exploit #742 - Adobe Flash - MovieClip Attach init Object Use-After-Free (March 18, 2020)

External References

https://helpx.adobe.com/security/products/flash-player/apsb17-02.html