#VU5943 Information disclosure in Adobe Flash Player and Adobe Flash Player for Linux - CVE-2017-3000
Published: March 14, 2017
Vulnerability identifier: #VU5943
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2017-3000
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Adobe Flash Player
Adobe Flash Player for Linux
Adobe Flash Player
Adobe Flash Player for Linux
Software vendor:
Adobe
Adobe
Description
The vulnerability allows a remote attacker to obtain potentially sensitive data.
The vulnerability exists due to boundary error in random number generator used for constant blinding in Adobe Flash Player. A remote unauthenticated attacker can create a specially crafted .swf file, trick the victim into opening i, trigger buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in disclosure of potentially sensitive data.
Remediation
Update to version 25.0.0.127.