{"id":"CVE-2017-3073","aliases":["EUVD-2017-12214","GHSA-r88h-g29r-792h","MGASA-2017-0143","RHSA-2017:1219","SUSE-SU-2017:1238-1","UBUNTU-CVE-2017-3073"],"status":"published","title":"Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free...","description":"Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0486,"percentile":0.92096,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2017-05-09T16:00:00Z","modified":"2026-06-29T10:16:11Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["25.0.0.171ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","fixed_in":["25.0.0.171ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0.171-1.mga5.nonfree"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.0.0.171-1.el6_9"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0.171-168.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0.171-168.1"}]}],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0.171ubuntu0.14.04.1"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.2","11.2.202.491ubuntu0.14.04.1","11.2.202.508ubuntu0.14.04.1","11.2.202.521ubuntu0.14.04.1","11.2.202.535ubuntu0.14.04.1","11.2.202.540ubuntu0.14.04.2","11.2.202.548ubuntu0.14.04.1","11.2.202.554ubuntu0.14.04.1","11.2.202.559ubuntu0.14.04.1","11.2.202.569ubuntu0.14.04.1","11.2.202.577ubuntu0.14.04.1","11.2.202.616ubuntu0.14.04.1","11.2.202.621ubuntu0.14.04.1","11.2.202.626ubuntu0.14.04.1","11.2.202.632ubuntu0.14.04.1","11.2.202.635ubuntu0.14.04.1","11.2.202.637ubuntu0.14.04.1","11.2.202.643ubuntu0.14.04.1","11.2.202.644ubuntu0.14.04.1","24.0.0.186ubuntu0.14.04.1","24.0.0.194ubuntu0.14.04.1","24.0.0.221ubuntu0.14.04.1","25.0.0.127ubuntu0.14.04.1","25.0.0.148ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.0.0.171ubuntu0.16.04.1"}]}],"versions":["11.2.202.540ubuntu2","11.2.202.548ubuntu1","11.2.202.554ubuntu1","11.2.202.559ubuntu1","11.2.202.569ubuntu1","11.2.202.577ubuntu1","11.2.202.616ubuntu1","11.2.202.621ubuntu0.16.04.1","11.2.202.626ubuntu0.16.04.1","11.2.202.632ubuntu0.16.04.1","11.2.202.635ubuntu0.16.04.1","11.2.202.637ubuntu0.16.04.1","11.2.202.643ubuntu0.16.04.1","11.2.202.644ubuntu0.16.04.1","24.0.0.186ubuntu0.16.04.1","24.0.0.194ubuntu0.16.04.1","24.0.0.221ubuntu0.16.04.1","25.0.0.127ubuntu0.16.04.1","25.0.0.148ubuntu0.16.04.1"]}],"products":[{"vendor":"adobe","product":"flash_player"},{"vendor":"adobe","product":"flash_player_desktop_runtime"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://security.gentoo.org/glsa/201705-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb17-15.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","article","report"]},{"url":"http://www.securityfocus.com/bid/98349","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1219","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1038427","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3073","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-r88h-g29r-792h"},{"url":"https://advisories.mageia.org/MGASA-2017-0143.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20818","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449340","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1219.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3068","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3069","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3069","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3069","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3070","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3070","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3070","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3071","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3071","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3071","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3072","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3072","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3072","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3073","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3073","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3074","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3074","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3074","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171238-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1038281","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3071","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3074","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-3073","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-3073","description":"Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-05-09T16:00:00Z","modified":"2024-08-05T14:16:27.434Z","updated_at":"2026-11-02T14:33:16.578111Z"}],"euvd":[{"id":"EUVD-2017-12214","description":"Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-05-09T16:00:00Z","modified":"2024-08-05T14:16:27Z","updated_at":"2026-11-03T02:39:19.04602Z"}],"ghsa":[{"id":"GHSA-r88h-g29r-792h","title":"Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free...","description":"Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2022-05-13T01:04:48Z","modified":"2023-01-30T18:30:28Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:47:50.554243Z"}],"nvd":[{"id":"CVE-2017-3073","description":"Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-05-09T16:29:00.37Z","modified":"2026-06-17T01:17:27.547Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:47.848196Z"}],"osv":[{"id":"RHSA-2017:1219","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T13:37:16Z","modified":"2026-06-29T10:16:11Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-3073","description":"Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable use after free vulnerability when handling multiple mask properties of display objects, aka memory corruption. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-05-09T16:29:00Z","modified":"2025-07-16T08:13:13.102864Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2017-0143","title":"Updated flash-player-plugin packages fix security vulnerability","description":"Adobe Flash Player 25.0.0.171 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow an\nattacker to take control of the affected system.\n\nThis updates resolves a use-after-free vulnerability that could lead to\ncode execution (CVE-2017-3071).\n\nThis updates resolves memory corruption vulnerabilities that could lead to\ncode execution (CVE-2017-3068, CVE-2017-3069, CVE-2017-3070,\nCVE-2017-3072, CVE-2017-3073, CVE-2017-3074).\n","status":"published","published":"2017-05-21T20:28:59Z","modified":"2026-04-16T06:22:38.105548288Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2017:1238-1","title":"Security update for flash-player","description":"\nThis update for flash-player fixes the following issues:\n\n- Security update to 25.0.0.171 (bsc#1038281), fixing the following\n  vulnerabilities advised under APSB17-15:\n  * Use-after-free vulnerability that could lead to code execution\n    (CVE-2017-3071).\n  * Memory corruption vulnerabilities that could lead to code execution\n    (CVE-2017-3068, CVE-2017-3069, CVE-2017-3070, CVE-2017-3072,\n    CVE-2017-3073, CVE-2017-3074).\n  * Details:\n    https://helpx.adobe.com/security/products/flash-player/apsb17-15.html\n","status":"published","published":"2017-05-10T16:37:04Z","modified":"2026-02-04T04:21:25.220457Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}