certfr_avis - certfr-2017-avi-255

CERTFR-2017-AVI-255

Vulnerability from certfr_avis

De multiples vulnérabilités ont été corrigées dans Adobe Flash Player. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Adobe	N/A	Adobe Flash Player pour Microsoft Edge et Internet Explorer 11 versions antérieures à 26.0.0.151 sur Windows 10 et 8.1
Adobe	N/A	Adobe Flash Player pour Google Chrome versions antérieures à 26.0.0.151 sur Windows, Macintosh, Linux et Chrome OS
Adobe	N/A	Adobe Flash Player Desktop Runtime versions antérieures à 26.0.0.151 sur Windows et Macintosh
Adobe	N/A	Adobe Flash Player Desktop Runtime versions antérieures à 26.0.0.151 sur Linux

References

Title

Publication Time

Tags

Bulletin de sécurité Adobe apsb17-23 du 08 août 2017

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Adobe Flash Player pour Microsoft Edge et Internet Explorer 11 versions ant\u00e9rieures \u00e0 26.0.0.151 sur Windows 10 et 8.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Flash Player pour Google Chrome versions ant\u00e9rieures \u00e0 26.0.0.151 sur Windows, Macintosh, Linux et Chrome OS",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Flash Player Desktop Runtime versions ant\u00e9rieures \u00e0 26.0.0.151 sur Windows et Macintosh",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    },
    {
      "description": "Adobe Flash Player Desktop Runtime versions ant\u00e9rieures \u00e0 26.0.0.151 sur Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Adobe",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2017-3085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-3085"
    },
    {
      "name": "CVE-2017-3106",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-3106"
    }
  ],
  "initial_release_date": "2017-08-09T00:00:00",
  "last_revision_date": "2017-08-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2017-AVI-255",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2017-08-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eAdobe Flash Player\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et\nune atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Adobe Flash Player",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Adobe apsb17-23 du 08 ao\u00fbt 2017",
      "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-23.html"
    }
  ]
}

CVE-2017-3085 (GCVE-0-2017-3085)

Vulnerability from cvelistv5

Published

2017-08-11 19:00

Modified

2024-09-16 18:23

Severity ?

CWE

Security Bypass

Summary

Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect.

References

URL

Tags

	http://www.securitytracker.com/id/1039088	vdb-entry, x_refsource_SECTRACK
	https://security.gentoo.org/glsa/201709-16	vendor-advisory, x_refsource_GENTOO
	https://access.redhat.com/errata/RHSA-2017:2457	vendor-advisory, x_refsource_REDHAT
	https://helpx.adobe.com/security/products/flash-player/apsb17-23.html	x_refsource_CONFIRM
	http://www.zerodayinitiative.com/advisories/ZDI-17-634/	x_refsource_MISC
	https://blog.bjornweb.nl/2017/08/flash-remote-sandbox-escape-windows-user-credentials-leak/	x_refsource_MISC
	http://www.securityfocus.com/bid/100191	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	Adobe Systems Incorporated	Flash Player	Version: 26.0.0.137 and earlier.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:16:27.863Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1039088",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039088"
          },
          {
            "name": "GLSA-201709-16",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201709-16"
          },
          {
            "name": "RHSA-2017:2457",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2457"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-23.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.zerodayinitiative.com/advisories/ZDI-17-634/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.bjornweb.nl/2017/08/flash-remote-sandbox-escape-windows-user-credentials-leak/"
          },
          {
            "name": "100191",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100191"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Flash Player",
          "vendor": "Adobe Systems Incorporated",
          "versions": [
            {
              "status": "affected",
              "version": "26.0.0.137 and earlier."
            }
          ]
        }
      ],
      "datePublic": "2017-08-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Security Bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "name": "1039088",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039088"
        },
        {
          "name": "GLSA-201709-16",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201709-16"
        },
        {
          "name": "RHSA-2017:2457",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2457"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-23.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.zerodayinitiative.com/advisories/ZDI-17-634/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.bjornweb.nl/2017/08/flash-remote-sandbox-escape-windows-user-credentials-leak/"
        },
        {
          "name": "100191",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100191"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "DATE_PUBLIC": "2017-08-08T00:00:00",
          "ID": "CVE-2017-3085",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Flash Player",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "26.0.0.137 and earlier."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Adobe Systems Incorporated"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Adobe Flash Player versions 26.0.0.137 and earlier have a security bypass vulnerability that leads to information disclosure when performing URL redirect."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Security Bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1039088",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039088"
            },
            {
              "name": "GLSA-201709-16",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201709-16"
            },
            {
              "name": "RHSA-2017:2457",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2457"
            },
            {
              "name": "https://helpx.adobe.com/security/products/flash-player/apsb17-23.html",
              "refsource": "CONFIRM",
              "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-23.html"
            },
            {
              "name": "http://www.zerodayinitiative.com/advisories/ZDI-17-634/",
              "refsource": "MISC",
              "url": "http://www.zerodayinitiative.com/advisories/ZDI-17-634/"
            },
            {
              "name": "https://blog.bjornweb.nl/2017/08/flash-remote-sandbox-escape-windows-user-credentials-leak/",
              "refsource": "MISC",
              "url": "https://blog.bjornweb.nl/2017/08/flash-remote-sandbox-escape-windows-user-credentials-leak/"
            },
            {
              "name": "100191",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100191"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2017-3085",
    "datePublished": "2017-08-11T19:00:00Z",
    "dateReserved": "2016-12-02T00:00:00",
    "dateUpdated": "2024-09-16T18:23:18.694Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-3106 (GCVE-0-2017-3106)

Vulnerability from cvelistv5

Published

2017-08-11 19:00

Modified

2024-09-16 16:33

Severity ?

CWE

Type Confusion

Summary

Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution.

References

URL

Tags

	https://www.exploit-db.com/exploits/42480/	exploit, x_refsource_EXPLOIT-DB
	http://www.securitytracker.com/id/1039088	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/100190	vdb-entry, x_refsource_BID
	https://security.gentoo.org/glsa/201709-16	vendor-advisory, x_refsource_GENTOO
	https://access.redhat.com/errata/RHSA-2017:2457	vendor-advisory, x_refsource_REDHAT
	https://helpx.adobe.com/security/products/flash-player/apsb17-23.html	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Adobe Systems Incorporated	Flash Player	Version: 26.0.0.137 and earlier.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T14:16:27.873Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "42480",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/42480/"
          },
          {
            "name": "1039088",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1039088"
          },
          {
            "name": "100190",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/100190"
          },
          {
            "name": "GLSA-201709-16",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201709-16"
          },
          {
            "name": "RHSA-2017:2457",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:2457"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-23.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Flash Player",
          "vendor": "Adobe Systems Incorporated",
          "versions": [
            {
              "status": "affected",
              "version": "26.0.0.137 and earlier."
            }
          ]
        }
      ],
      "datePublic": "2017-08-08T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Type Confusion",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "name": "42480",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/42480/"
        },
        {
          "name": "1039088",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1039088"
        },
        {
          "name": "100190",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/100190"
        },
        {
          "name": "GLSA-201709-16",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201709-16"
        },
        {
          "name": "RHSA-2017:2457",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:2457"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-23.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "DATE_PUBLIC": "2017-08-08T00:00:00",
          "ID": "CVE-2017-3106",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Flash Player",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "26.0.0.137 and earlier."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Adobe Systems Incorporated"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Adobe Flash Player versions 26.0.0.137 and earlier have an exploitable type confusion vulnerability when parsing SWF files. Successful exploitation could lead to arbitrary code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Type Confusion"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "42480",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/42480/"
            },
            {
              "name": "1039088",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1039088"
            },
            {
              "name": "100190",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/100190"
            },
            {
              "name": "GLSA-201709-16",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201709-16"
            },
            {
              "name": "RHSA-2017:2457",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:2457"
            },
            {
              "name": "https://helpx.adobe.com/security/products/flash-player/apsb17-23.html",
              "refsource": "CONFIRM",
              "url": "https://helpx.adobe.com/security/products/flash-player/apsb17-23.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2017-3106",
    "datePublished": "2017-08-11T19:00:00Z",
    "dateReserved": "2016-12-02T00:00:00",
    "dateUpdated": "2024-09-16T16:33:04.918Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2017-AVI-255

Vulnerability from certfr_avis

Solution

CVE-2017-3085 (GCVE-0-2017-3085)

Vulnerability from cvelistv5

CVE-2017-3106 (GCVE-0-2017-3106)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature