VDB
CVE-2017-11292
CVE-2017-11292
PUBLISHED
KEV
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
EPSS 11.89% · 95.8th percentile
Risk Scores
EPSS Score
11.89%
95.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:14.04:LTS | flashplugin-nonfree | 0, 11.2.202.310ubuntu1, 11.2.202.332ubuntu1 |
| Ubuntu:16.04:LTS | flashplugin-nonfree | 0, 11.2.202.540ubuntu2, 11.2.202.548ubuntu1 |
Timeline
- Oct 16, 2017 CVE Published
- Oct 16, 2017 PoC Published
- Apr 14, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Mar 3, 2022 CISA KEV Added
- May 2, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- May 14, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-11292 third-party-advisory
- http://www.securitytracker.com/id/1039582 third-party-advisory
- https://helpx.adobe.com/security/products/flash-player/apsb17-32.html third-party-advisory
- https://security.gentoo.org/glsa/201710-22 third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-11292 third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog third-party-advisory