Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-11282: Adobe Flash Player could allow attackers to run code

CVE-2017-11282 · published 8 years ago

Summary

Versions of Adobe Flash Player up to 26.0.0.151, including those shipped with Red Hat Enterprise Linux desktop, server and workstation editions, contain a bug that can be triggered by specially crafted MP4 files. An attacker could use this to execute any program on the affected computer. Apply the latest Flash Player update from Adobe or remove Flash from the system if it is no longer needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
adobe	flash_player	<= 26.0.0.151 `cpe:2.3:a:adobe:flash_player::::::::`
redhat	enterprise_linux_desktop	6.0 `cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*`
redhat	enterprise_linux_server	6.0 `cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*`
redhat	enterprise_linux_workstation	6.0 `cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*`

Original advisory text

Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.

References

http://packetstormsecurity.com/files/144332/Adobe-Flash-appleToRange-Out-Of-Boun... Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/100716 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039314 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:2702 Third Party Advisory
https://bugs.chromium.org/p/project-zero/issues/detail?id=1323 Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb17-28.html Vendor Advisory
https://security.gentoo.org/glsa/201709-16 Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/42783/ Exploit Third Party Advisory VDB Entry
https://www.youtube.com/watch?v=6iZnIQbRf5M Exploit Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

34% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published1 Dec 2017

Updated5 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-11282 · NVD

Track software like this

Free during beta