Heap-based buffer overflow in Adobe Flash Player and Adobe Flash Player for Linux - CVE-2017-2992

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in Adobe Flash Player when processing malformed .swf files. A remote attacker can create a specially crafted .swf file, trick the victim into opening it, trigger heap-based buffer overflow and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Affected software

How to mitigate CVE-2017-2992

Links to Public Exploits and PoC-codes

• Exploit #1036 - Adobe Flash - MP4 AMF Parsing Overflow (March 18, 2020)

External References

• https://helpx.adobe.com/security/products/flash-player/apsb17-04.html

Related Security Bulletins

• Multiple vulnerabilities in Adobe Flash Player
• Microsoft security update for Adobe Flash Player
• Gentoo update for Adobe Flash Player
• Arch Linux update for lib32-flashplugin
• Arch Linux update for flashplugin
• SUSE Linux update for flash-player
• Red Hat update for flash-plugin