CVE-2017-11292

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 11,9%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada adobe flash player desktop runtime, adobe flash player +3 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 Maret 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

Rincian

Terbit di NVD

22 Oktober 2017

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

11,9% peluang dieksploitasi; lebih tinggi dari 96,0% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Adobe Flash Player Type Confusion Vulnerability

Masuk KEV

3 Maret 2022

Tenggat CISA

24 Maret 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

The impacted product is end-of-life and should be disconnected if still in use.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://helpx.adobe.com/security/products/flash-player/apsb17-32.html patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 pemerintah AS
• http://www.securityfocus.com/bid/101286 broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1039582 broken link · advisory pihak ketiga · vdb entry
• https://access.redhat.com/errata/RHSA-2017:2899 advisory pihak ketiga
• https://security.gentoo.org/glsa/201710-22 advisory pihak ketiga