Code execution vulnerabilities in Adobe Flash Player

Beschreibung

Multiple serious vulnerabilities have been found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A type confusion vulnerability related to the MessageChannel class can be exploited remotely to execute arbitrary code;
2. An integer overflow vulnerability related to Flash Broker COM can be exploited remotely to execute arbitrary code;
3. Use-after-free vulnerabilities can be exploited remotely to execute arbitrary code;
4. Heap buffer overflow vulnerabilities can be exploited remotely to execute arbitrary code;
5. Memory corruption vulnerabilities can be exploited remotely to execute arbitrary code.

---

Technical details

Vulnerabilities (3) occur in a routine related to player shutdown, in the ActionScript 3 BitmapData class, in Primetime SDK event dispatch or might be related to event handlers.

Vulnerabilities (4) occur in the h264 decoder routine, in the Flash Video (FLV) codec and while parsing an MP4 header.

Vulnerabilities (5) occur while performing garbage collection, in the h264 codec (related to decompression) and in Primetime SDK.
To update Adobe Flash Player ActiveX (detected as Flash.ocx) on Windows 8 and higher, install latest updates from Control Panel

Ursprüngliche Informationshinweise

• Adobe Security Bulletin

CVE Liste

• CVE-2017-2982
  critical
• CVE-2017-2984
  critical
• CVE-2017-2985
  critical
• CVE-2017-2986
  critical
• CVE-2017-2987
  critical
• CVE-2017-2988
  critical
• CVE-2017-2990
  critical
• CVE-2017-2991
  critical
• CVE-2017-2992
  critical
• CVE-2017-2993
  critical
• CVE-2017-2994
  critical
• CVE-2017-2995
  critical
• CVE-2017-2996
  critical

Mehr erfahren

Informieren Sie sich über die Statistiken der in Ihrer Region verbreiteten Sicherheitslücken statistics.securelist.com