{"id":"CVE-2017-11282","aliases":["EUVD-2017-2916","GHSA-vq94-9f8p-793h","MGASA-2017-0339","RHSA-2017:2702","UBUNTU-CVE-2017-11282"],"status":"published","title":"Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser....","description":"Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.3405,"percentile":0.9841,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-119"],"published":"2017-09-14T18:21:43Z","modified":"2026-06-29T10:17:45Z","exploits":[{"source":"exploitdb","id":"EDB-42783","title":"Adobe Flash - Out-of-Bounds Read in applyToRange","type":"dos","platform":"multiple","date":"2017-09-25","verified":true,"url":"https://www.exploit-db.com/exploits/42783"}],"fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["27.0.0.130ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","fixed_in":["27.0.0.130ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.0.0.130-1.mga5.nonfree"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.0.0.130-1.mga6.nonfree"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:27.0.0.130-1.el6_9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.0.0.130ubuntu0.14.04.1"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.2","11.2.202.491ubuntu0.14.04.1","11.2.202.508ubuntu0.14.04.1","11.2.202.521ubuntu0.14.04.1","11.2.202.535ubuntu0.14.04.1","11.2.202.540ubuntu0.14.04.2","11.2.202.548ubuntu0.14.04.1","11.2.202.554ubuntu0.14.04.1","11.2.202.559ubuntu0.14.04.1","11.2.202.569ubuntu0.14.04.1","11.2.202.577ubuntu0.14.04.1","11.2.202.616ubuntu0.14.04.1","11.2.202.621ubuntu0.14.04.1","11.2.202.626ubuntu0.14.04.1","11.2.202.632ubuntu0.14.04.1","11.2.202.635ubuntu0.14.04.1","11.2.202.637ubuntu0.14.04.1","11.2.202.643ubuntu0.14.04.1","11.2.202.644ubuntu0.14.04.1","24.0.0.186ubuntu0.14.04.1","24.0.0.194ubuntu0.14.04.1","24.0.0.221ubuntu0.14.04.1","25.0.0.127ubuntu0.14.04.1","25.0.0.148ubuntu0.14.04.1","25.0.0.171ubuntu0.14.04.1","26.0.0.126ubuntu0.14.04.1","26.0.0.131ubuntu0.14.04.1","26.0.0.137ubuntu0.14.04.1","26.0.0.151ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"27.0.0.130ubuntu0.16.04.1"}]}],"versions":["11.2.202.540ubuntu2","11.2.202.548ubuntu1","11.2.202.554ubuntu1","11.2.202.559ubuntu1","11.2.202.569ubuntu1","11.2.202.577ubuntu1","11.2.202.616ubuntu1","11.2.202.621ubuntu0.16.04.1","11.2.202.626ubuntu0.16.04.1","11.2.202.632ubuntu0.16.04.1","11.2.202.635ubuntu0.16.04.1","11.2.202.637ubuntu0.16.04.1","11.2.202.643ubuntu0.16.04.1","11.2.202.644ubuntu0.16.04.1","24.0.0.186ubuntu0.16.04.1","24.0.0.194ubuntu0.16.04.1","24.0.0.221ubuntu0.16.04.1","25.0.0.127ubuntu0.16.04.1","25.0.0.148ubuntu0.16.04.1","25.0.0.171ubuntu0.16.04.1","26.0.0.126ubuntu0.16.04.1","26.0.0.131ubuntu0.16.04.1","26.0.0.137ubuntu0.16.04.1","26.0.0.151ubuntu0.16.04.1"]}],"products":[{"vendor":"adobe","product":"flash_player"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"http://packetstormsecurity.com/files/144332/Adobe-Flash-appleToRange-Out-Of-Bounds-Read.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1323","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/100716","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.youtube.com/watch?v=6iZnIQbRf5M","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://security.gentoo.org/glsa/201709-16","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/42783/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb17-28.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","article"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2702","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1039314","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11282","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/42783"},{"url":"https://github.com/advisories/GHSA-vq94-9f8p-793h"},{"url":"https://advisories.mageia.org/MGASA-2017-0339.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21703","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1491110","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2702.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11281","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11282","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2017-11282","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2017-2702.html","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-11282","description":"Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.","status":"published","published":"2017-12-01T08:00:00Z","modified":"2024-08-05T18:05:30.355Z","updated_at":"2026-11-02T14:33:20.171335Z"}],"euvd":[{"id":"EUVD-2017-2916","description":"Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.","status":"published","published":"2017-12-01T08:00:00Z","modified":"2024-08-05T18:05:30Z","updated_at":"2026-11-03T02:23:24.20034Z"}],"ghsa":[{"id":"GHSA-vq94-9f8p-793h","title":"Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser....","description":"Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.","status":"published","published":"2022-05-13T01:06:33Z","modified":"2025-04-20T03:50:22Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:56.679657Z"}],"nvd":[{"id":"CVE-2017-11282","description":"Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.","status":"published","published":"2017-12-01T08:29:00.263Z","modified":"2026-06-17T01:01:32.87Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"RHSA-2017:2702","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T13:38:49Z","modified":"2026-06-29T10:17:45Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-11282","description":"Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. This affects 26.0.0.151 and earlier.","status":"published","published":"2017-12-01T08:29:00Z","modified":"2025-07-16T07:35:43.433473Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"MGASA-2017-0339","title":"Updated flash-player-plugin packages fix security vulnerability","description":"Adobe Flash Player 27.0.0.130 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow an\nattacker to take control of the affected system.\n\nThis update addresses two memory corruption vulnerabilities that could\nlead to code execution (CVE-2017-11281, CVE-2017-11282).\n","status":"published","published":"2017-09-14T18:21:43Z","modified":"2026-04-16T06:25:18.93441613Z","updated_at":"2026-11-02T15:49:40.442238Z"}]}}