Multiple vulnerabilities in Adobe Flash Player

Описание

Multiple serious vulnerabilities have been found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information or execute arbitrary code.

Below is a complete list of vulnerabilities:

1. Vulnerability related to handling TCP connections can be exploited remotely to bypass security restrictions;
2. Use-after-free vulnerabilities in the ActionScript MovieClip and FileReference classes (when using class inheritance) can be exploited remotely to execute arbitrary code;
3. Heap buffer overflow vulnerabilities occuring while processing Adobe Texture Format files or Flash Video container file format can be exploited remotely to execute arbitrary code;
4. Heap buffer overflow vulnerability related to texture compression can be exploited remotely to execute arbitrary code;
5. Memory corruption vulnerability in the JPEG XR codec can be exploited remotely to execute arbitrary code;
6. Memory corruption vulnerabilities related to processing of atoms of MP4 files, setting visual mode effects and parsing metadata can be exploited remotely to execute arbitrary code;
7. Memory corruption vulnerability occuring while manipulating a display list because of a concurrency error can be exploited remotely to execute arbitrary code.

---

Technical details

To update Adobe Flash Player ActiveX (detected as Flash.ocx) on Windows 8 and higher, install latest updates from Control Panel

Первичный источник обнаружения

• Adobe Security Bulletin
  

Эксплуатация

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Связанные продукты

• Adobe-Flash-Player-ActiveX
• Adobe-Flash-Player-NPAPI
• Macromedia-Flash-Player
• Adobe-Flash-Player-PPAPI

Список CVE

• CVE-2017-2925
  critical
• CVE-2017-2926
  critical
• CVE-2017-2927
  critical
• CVE-2017-2928
  critical
• CVE-2017-2930
  critical
• CVE-2017-2931
  critical
• CVE-2017-2932
  critical
• CVE-2017-2933
  critical
• CVE-2017-2934
  critical
• CVE-2017-2935
  critical
• CVE-2017-2936
  critical
• CVE-2017-2937
  critical
• CVE-2017-2938
  warning

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com