CVE-2017-3000
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number...
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.
- Record
CVE-2017-3000- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.
- Record
CVE-2017-3000- Updated
- 2026-11-02
EUVDEUVD-2017-12141 No score
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.
- Record
EUVD-2017-12141- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vh5p-gf3p-64qv
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number...
Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successful exploitation could lead to information disclosure.
- Record
GHSA-vh5p-gf3p-64qv- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVRHSA-2017:0526
Red Hat Security Advisory: flash-plugin security update
- Record
RHSA-2017:0526- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0087 No score
Updated flash-player-plugin packages fix security vulnerability
Updated flash-player-plugin installs latest version for the flash plugin from adobe. See the referenced security bulletin for details.
- Record
MGASA-2017-0087- Updated
- 2026-11-02
OSVSUSE-SU-2017:0703-1 No score
Security update for flash-player
This update for flash-player fixes the following issues:
Security update to 25.0.0.127 (bsc#1029374), fixing the following vulnerabilities advised under APSB17-07:
- CVE-2017-2997: This update resolves a buffer overflow vulnerability that could lead to code execution.
- CVE-2017-2998, CVE-2017-2999: This update resolves memory corruption vulnerabilities that could lead to code execution.
- CVE-2017-3000: This update resolves a random number generator vulnerability used for constant blinding that could lead to information disclosure.
- CVE-2017-3001, CVE-2017-3002, CVE-2017-3003: This update resolves use-after-free vulnerabilities that could lead to code execution.
- Details: https://helpx.adobe.com/security/products/flash-player/apsb17-07.html
- Record
SUSE-SU-2017:0703-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 From an advisory covering 7 CVEs |
before 25.0.0.127-1.mga5.nonfree | 25.0.0.127-1.mga5.nonfree |
flash-pluginRed Hat:rhel_extras:6 From an advisory covering 8 CVEs |
before 0:25.0.0.127-1.el6_8 | 0:25.0.0.127-1.el6_8 |
flash-playerSUSE:Linux Enterprise Desktop 12 SP1 From an advisory covering 7 CVEs |
before 25.0.0.127-162.1 | 25.0.0.127-162.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 SP1 From an advisory covering 7 CVEs |
before 25.0.0.127-162.1 | 25.0.0.127-162.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | dangokyo/CVE-2017-3000 | 2018-08-26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-3000 is a medium vulnerability (CVSS 6.5) in Adobe Flash Player, published March 14, 2017. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.36%, the 94th percentile. No source names a fixed version.
References
securityfocus.com/bid/96862
helpx.adobe.com/security/products/flash-player/apsb17-07.html
security.gentoo.org/glsa/201703-02
securitytracker.com/id/1037994
rhn.redhat.com/errata/RHSA-2017-0526.html
nvd.nist.gov/vuln/detail/CVE-2017-3000
Show 39 moreShow less
github.com/advisories/GHSA-vh5p-gf3p-64qv
advisories.mageia.org/MGASA-2017-0087.html
bugs.mageia.org/show_bug.cgi?id=20536
access.redhat.com/errata/RHSA-2017:0526
bugzilla.redhat.com/show_bug.cgi?id=1432200
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0526.json
cve.org/CVERecord?id=CVE-2017-2994
suse.com/support/update/announcement/2017/suse-su-20170703-1
bugzilla.suse.com/1029374