VulnerabilityModified
CVE-2017-3079
Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the internal representation of raster data.
CRITICAL 9.8EPSS 6.99%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.99%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable memory corruption vulnerability in the internal representation of raster data. Successful exploitation could lead to arbitrary code execution.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 6.99% probability · 94th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- adobe/flash player
- Source
- psirt@adobe.com
References
- http://www.securityfocus.com/bid/99025Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038655
- https://access.redhat.com/errata/RHSA-2017:1439
- https://helpx.adobe.com/security/products/flash-player/apsb17-17.htmlVendor Advisory
- https://security.gentoo.org/glsa/201707-15
- http://www.securityfocus.com/bid/99025Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038655
- https://access.redhat.com/errata/RHSA-2017:1439
- https://helpx.adobe.com/security/products/flash-player/apsb17-17.htmlVendor Advisory
- https://security.gentoo.org/glsa/201707-15
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.