{"id":"CVE-2017-2999","aliases":["EUVD-2017-12140","GHSA-ggwr-6xg7-m7g8","MGASA-2017-0087","RHSA-2017:0526","SUSE-SU-2017:0703-1"],"status":"published","title":"Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption...","description":"Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04101,"percentile":0.90815,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-787"],"published":"2017-03-14T16:00:00Z","modified":"2026-06-29T10:15:37Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0.127-1.mga5.nonfree"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.0.0.127-1.el6_8"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0.127-162.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0.127-162.1"}]}],"bundled":7}],"products":[{"vendor":"adobe","product":"flash_player"},{"vendor":"adobe","product":"flash_player_desktop_runtime"}],"references":[{"url":"https://helpx.adobe.com/security/products/flash-player/apsb17-07.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","article"]},{"url":"https://security.gentoo.org/glsa/201703-02","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/96866","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037994","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0526.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2999","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ggwr-6xg7-m7g8"},{"url":"https://advisories.mageia.org/MGASA-2017-0087.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20536","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0526","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1432200","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0526.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2994","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2994","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2994","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2997","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2997","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2997","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2998","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2998","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2998","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2999","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3000","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3000","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3000","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3001","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3001","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3001","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3002","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3002","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3003","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3003","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3003","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170703-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1029374","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3003","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-2999","description":"Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-03-14T16:00:00Z","modified":"2024-08-05T14:09:17.8Z","updated_at":"2026-11-02T14:33:15.543086Z"}],"euvd":[{"id":"EUVD-2017-12140","description":"Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-03-14T16:00:00Z","modified":"2024-08-05T14:09:17Z","updated_at":"2026-11-03T02:39:19.516435Z"}],"ghsa":[{"id":"GHSA-ggwr-6xg7-m7g8","title":"Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption...","description":"Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2022-05-14T03:54:44Z","modified":"2023-01-24T15:30:22Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:41:42.013329Z"}],"nvd":[{"id":"CVE-2017-2999","description":"Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality related to hosting playback surface. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-03-14T16:59:00.287Z","modified":"2026-06-17T01:17:18.23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:44.275273Z"}],"osv":[{"id":"RHSA-2017:0526","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T13:37:22Z","modified":"2026-06-29T10:15:37Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"MGASA-2017-0087","title":"Updated flash-player-plugin packages fix security vulnerability","description":"Updated flash-player-plugin installs latest version for the flash plugin\nfrom adobe. See the referenced security bulletin for details.\n","status":"published","published":"2017-03-25T16:56:41Z","modified":"2026-04-16T06:25:58.057587242Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2017:0703-1","title":"Security update for flash-player","description":"\nThis update for flash-player fixes the following issues:\n\nSecurity update to 25.0.0.127 (bsc#1029374), fixing the following vulnerabilities advised under APSB17-07:\n- CVE-2017-2997: This update resolves a buffer overflow vulnerability that could lead to code execution.\n- CVE-2017-2998, CVE-2017-2999: This update resolves memory corruption vulnerabilities that could lead to\n  code execution.\n- CVE-2017-3000: This update resolves a random number generator vulnerability used for constant blinding\n  that could lead to information disclosure.\n- CVE-2017-3001, CVE-2017-3002, CVE-2017-3003: This update resolves use-after-free vulnerabilities that\n  could lead to code execution.\n- Details:\n  https://helpx.adobe.com/security/products/flash-player/apsb17-07.html\n","status":"published","published":"2017-03-15T14:21:27Z","modified":"2026-02-04T03:32:11.097685Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}