CVE-2017-11213
9.8
CRITICAL · CVSS 3.0 · EPSS 6.5% (pctl 94)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer due to an integer overflow; the computation is part of the abstraction that creates an arbitrarily sized transparent or opaque bitmap image. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 6.52% — more likely to be exploited than 94% of all CVEs |
| Weakness | CWE-125 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2017-12-09 |
| Last modified | 2026-06-17 |
Affected (10)
| Vendor | Product |
|---|---|
| adobe | flash player |
| apple | macos |
| chrome os | |
| linux | linux kernel |
| microsoft | windows |
| microsoft | windows 10 |
| microsoft | windows 8.1 |
| redhat | enterprise linux desktop |
| redhat | enterprise linux server |
| redhat | enterprise linux workstation |
References
- http://www.securityfocus.com/bid/101837
- http://www.securitytracker.com/id/1039778
- https://access.redhat.com/errata/RHSA-2017:3222
- https://helpx.adobe.com/security/products/flash-player/apsb17-33.html
- https://security.gentoo.org/glsa/201711-13
- http://www.securityfocus.com/bid/101837
- http://www.securitytracker.com/id/1039778
- https://access.redhat.com/errata/RHSA-2017:3222
- https://helpx.adobe.com/security/products/flash-player/apsb17-33.html
- https://security.gentoo.org/glsa/201711-13
→ the Explorer · watch your stack · NVD