Main Vulnerability Database Vulnerabilities #VU5943

Information disclosure in Adobe Flash Player for Linux and Adobe Flash Player - CVE-2017-3000

Published: March 14, 2017

Vulnerability identifier: #VU5943

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3000

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive data.

The vulnerability exists due to boundary error in random number generator used for constant blinding in Adobe Flash Player. A remote unauthenticated attacker can create a specially crafted .swf file, trick the victim into opening i, trigger buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in disclosure of potentially sensitive data.

Affected software

Adobe Flash Player for Linux
Adobe Flash Player
Arch Linux
Microsoft Windows
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Windows Server

How to mitigate CVE-2017-3000

Update to version 25.0.0.127.

Links to Public Exploits and PoC-codes

Exploit #129 - CVE-2017-3000 (A full exploit of CVE-2017-3000 on Flash Player Constant Blinding PRNG) (March 18, 2020)

External References

https://helpx.adobe.com/security/products/flash-player/apsb17-07.html