Heap-based buffer overflow in Adobe Flash Player and Adobe Flash Player for Linux - CVE-2017-2986

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Adobe Flash Player when processing malformed .swf files. A remote attacker can create a specially crafted .swf file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

How to mitigate CVE-2017-2986

Links to Public Exploits and PoC-codes

• Exploit #1035 - Adobe Flash - YUVPlane Decoding Heap Overflow (March 18, 2020)

External References

• https://helpx.adobe.com/security/products/flash-player/apsb17-04.html

Related Security Bulletins

• Multiple vulnerabilities in Adobe Flash Player
• Microsoft security update for Adobe Flash Player
• Gentoo update for Adobe Flash Player
• SUSE Linux update for flash-player
• Red Hat update for flash-plugin