Main Vulnerability Database Vulnerabilities #VU7697

Type confusion error in Adobe Flash Player - CVE-2017-3106

Published: August 8, 2017 / Updated: September 14, 2018

Vulnerability identifier: #VU7697

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-3106

CWE-ID: CWE-843

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system

The vulnerability exists due to a type confusion error when processing .swf files. A remote attacker can create a specially crafted .swf file, trick the victim into opening it and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Affected software

Adobe Flash Player
Adobe Flash Player for Microsoft Windows
Arch Linux
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop

How to mitigate CVE-2017-3106

Update to version 26.0.0.151

Links to Public Exploits and PoC-codes

Exploit #1273 - Adobe Flash - Invoke Accesses Trait Out-of-Bounds (March 18, 2020)

External References

https://helpx.adobe.com//security/products/flash-player/apsb17-23.html