Main Vulnerability Database Vulnerabilities #VU4094

Heap-based buffer overflow in Adobe Flash Player and Adobe Flash Player for Linux - CVE-2017-2934

Published: January 10, 2017 / Updated: March 16, 2017

Vulnerability identifier: #VU4094

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-2934

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allow a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when decompressing planar block within .swf files. A remote attacker can create a specially crafted. atf file, trick the victim into opening it using Flash Player, cause heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Adobe Flash Player
Adobe Flash Player for Linux
Gentoo Linux
Arch Linux
Windows RT
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Microsoft Windows
Windows Server

How to mitigate CVE-2017-2934

Install the latest version of Adobe Flash Player 24.0.0.194.

Links to Public Exploits and PoC-codes

Exploit #744 - Adobe Flash - ATF Planar Decompression Heap Overflow (March 18, 2020)

External References

https://helpx.adobe.com/security/products/flash-player/apsb17-02.html