ID CVE-2017-3106
Summary Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.
References
Vulnerable Configurations
  • Adobe Flash Player 26.0.0.137
    cpe:2.3:a:adobe:flash_player:26.0.0.137
  • Apple Mac OS
    cpe:2.3:o:apple:mac_os
  • Linux Kernel
    cpe:2.3:o:linux:linux_kernel
  • Microsoft Windows
    cpe:2.3:o:microsoft:windows
  • Adobe Flash Player 26.0.0.137 for Edge
    cpe:2.3:a:adobe:flash_player:26.0.0.137:-:-:-:-:edge
  • Adobe Flash Player 26.0.0.137 for Internet Explorer 11
    cpe:2.3:a:adobe:flash_player:26.0.0.137:-:-:-:-:internet_explorer_11
  • cpe:2.3:o:microsoft:windows_10
    cpe:2.3:o:microsoft:windows_10
  • cpe:2.3:o:microsoft:windows_8.1
    cpe:2.3:o:microsoft:windows_8.1
  • Adobe Flash Player 26.0.0.137 for Chrome
    cpe:2.3:a:adobe:flash_player:26.0.0.137:-:-:-:-:chrome
  • Apple Mac OS X
    cpe:2.3:o:apple:mac_os_x
  • cpe:2.3:o:google:chrome_os
    cpe:2.3:o:google:chrome_os
  • Linux Kernel
    cpe:2.3:o:linux:linux_kernel
  • Microsoft Windows
    cpe:2.3:o:microsoft:windows
CVSS
Base: 9.3
Impact:
Exploitability:
CWE CWE-704
CAPEC
exploit-db via4
description Adobe Flash - Invoke Accesses Trait Out-of-Bounds. CVE-2017-3106. Dos exploit for Windows platform
file exploits/windows/dos/42480.txt
id EDB-ID:42480
last seen 2017-08-17
modified 2017-08-17
platform windows
port
published 2017-08-17
reporter Exploit-DB
source https://www.exploit-db.com/download/42480/
title Adobe Flash - Invoke Accesses Trait Out-of-Bounds
type dos
nessus via4
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_7E3D3E9A7D8F11E7A02BD43D7EF03AA6.NASL
    description Adobe reports : - These updates resolve security bypass vulnerability that could lead to information disclosure (CVE-2017-3085). - These updates resolve type confusion vulnerability that could lead to remote code execution (CVE-2017-3106).
    last seen 2018-02-02
    modified 2018-02-01
    plugin id 102331
    published 2017-08-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102331
    title FreeBSD : Flash Player -- multiple vulnerabilities (7e3d3e9a-7d8f-11e7-a02b-d43d7ef03aa6)
  • NASL family Windows
    NASL id FLASH_PLAYER_APSB17-23.NASL
    description The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 26.0.0.137. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to an unspecified flaw. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted Flash content, to disclose sensitive information. (CVE-2017-3085) - A remote code execution vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted Flash content, to execute arbitrary code. (CVE-2017-3106)
    last seen 2017-10-29
    modified 2017-09-14
    plugin id 102262
    published 2017-08-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102262
    title Adobe Flash Player <= 26.0.0.137 Multiple Vulnerabilities (APSB17-23)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FLASH_PLAYER_APSB17-23.NASL
    description The version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 26.0.0.137. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to an unspecified flaw. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted Flash content, to disclose sensitive information. (CVE-2017-3085) - A remote code execution vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted Flash content, to execute arbitrary code. (CVE-2017-3106)
    last seen 2017-10-29
    modified 2017-09-14
    plugin id 102263
    published 2017-08-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102263
    title Adobe Flash Player for Mac <= 26.0.0.137 Multiple Vulnerabilities (APSB17-23)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2017-2457.NASL
    description An update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 26.0.0.151. Security Fix(es) : * This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2017-3085, CVE-2017-3106)
    last seen 2018-01-26
    modified 2018-01-25
    plugin id 102411
    published 2017-08-11
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102411
    title RHEL 6 : flash-plugin (RHSA-2017:2457)
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201709-16.NASL
    description The remote host is affected by the vulnerability described in GLSA-201709-16 (Adobe Flash Player: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the referenced CVE identifiers for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process or bypass security restrictions. Workaround : There is no known workaround at this time.
    last seen 2018-01-27
    modified 2018-01-26
    plugin id 103444
    published 2017-09-25
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=103444
    title GLSA-201709-16 : Adobe Flash Player: Multiple vulnerabilities
  • NASL family Windows : Microsoft Bulletins
    NASL id SMB_NT_MS17_AUG_4034662.NASL
    description The remote Windows host is missing security update KB4034662. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to an unspecified flaw. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted Flash content, to disclose sensitive information. (CVE-2017-3085) - A remote code execution vulnerability exists due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted Flash content, to execute arbitrary code. (CVE-2017-3106)
    last seen 2018-01-17
    modified 2018-01-16
    plugin id 102266
    published 2017-08-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=102266
    title KB4034662: Security update for Adobe Flash Player (August 2017)
redhat via4
advisories
rhsa
id RHSA-2017:2457
refmap via4
bid 100190
confirm https://helpx.adobe.com/security/products/flash-player/apsb17-23.html
gentoo GLSA-201709-16
sectrack 1039088
Last major update 11-08-2017 - 15:29
Published 11-08-2017 - 15:29
Last modified 04-01-2018 - 21:31
Back to Top