{"id":"CVE-2017-3083","aliases":["EUVD-2017-12224","GHSA-3grj-6wj3-qgc3","MGASA-2017-0172","RHSA-2017:1439","UBUNTU-CVE-2017-3083"],"status":"published","title":"Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free...","description":"Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the Primetime SDK functionality related to the profile metadata of the media stream. Successful exploitation could lead to arbitrary code execution.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.15866,"percentile":0.96904,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2017-06-14T13:50:35Z","modified":"2026-06-29T10:16:28Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["26.0.0.126ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","fixed_in":["26.0.0.126ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.126-1.mga5.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.0.0.126-1.el6_9"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.126ubuntu0.14.04.1"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.2","11.2.202.491ubuntu0.14.04.1","11.2.202.508ubuntu0.14.04.1","11.2.202.521ubuntu0.14.04.1","11.2.202.535ubuntu0.14.04.1","11.2.202.540ubuntu0.14.04.2","11.2.202.548ubuntu0.14.04.1","11.2.202.554ubuntu0.14.04.1","11.2.202.559ubuntu0.14.04.1","11.2.202.569ubuntu0.14.04.1","11.2.202.577ubuntu0.14.04.1","11.2.202.616ubuntu0.14.04.1","11.2.202.621ubuntu0.14.04.1","11.2.202.626ubuntu0.14.04.1","11.2.202.632ubuntu0.14.04.1","11.2.202.635ubuntu0.14.04.1","11.2.202.637ubuntu0.14.04.1","11.2.202.643ubuntu0.14.04.1","11.2.202.644ubuntu0.14.04.1","24.0.0.186ubuntu0.14.04.1","24.0.0.194ubuntu0.14.04.1","24.0.0.221ubuntu0.14.04.1","25.0.0.127ubuntu0.14.04.1","25.0.0.148ubuntu0.14.04.1","25.0.0.171ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.126ubuntu0.16.04.1"}]}],"versions":["11.2.202.540ubuntu2","11.2.202.548ubuntu1","11.2.202.554ubuntu1","11.2.202.559ubuntu1","11.2.202.569ubuntu1","11.2.202.577ubuntu1","11.2.202.616ubuntu1","11.2.202.621ubuntu0.16.04.1","11.2.202.626ubuntu0.16.04.1","11.2.202.632ubuntu0.16.04.1","11.2.202.635ubuntu0.16.04.1","11.2.202.637ubuntu0.16.04.1","11.2.202.643ubuntu0.16.04.1","11.2.202.644ubuntu0.16.04.1","24.0.0.186ubuntu0.16.04.1","24.0.0.194ubuntu0.16.04.1","24.0.0.221ubuntu0.16.04.1","25.0.0.127ubuntu0.16.04.1","25.0.0.148ubuntu0.16.04.1","25.0.0.171ubuntu0.16.04.1"]}],"products":[{"vendor":"adobe","product":"flash_player"}],"references":[{"url":"https://helpx.adobe.com/security/products/flash-player/apsb17-17.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","article","report"]},{"url":"http://www.securityfocus.com/bid/99023","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1038655","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1439","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/201707-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3083","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3grj-6wj3-qgc3"},{"url":"https://advisories.mageia.org/MGASA-2017-0172.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21083","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461146","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1439.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3075","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3075","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3075","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3076","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3076","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3076","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3077","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3077","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3077","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3078","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3078","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3079","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3079","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3081","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3081","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3082","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3082","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3083","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3084","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3084","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3084","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-3083","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-3083","description":"Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the Primetime SDK functionality related to the profile metadata of the media stream. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-06-20T17:00:00Z","modified":"2024-08-05T14:16:27.506Z","updated_at":"2026-11-02T14:33:15.887816Z"}],"euvd":[{"id":"EUVD-2017-12224","description":"Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the Primetime SDK functionality related to the profile metadata of the media stream. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-06-20T17:00:00Z","modified":"2024-08-05T14:16:27Z","updated_at":"2026-11-03T02:39:19.04602Z"}],"ghsa":[{"id":"GHSA-3grj-6wj3-qgc3","title":"Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free...","description":"Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the Primetime SDK functionality related to the profile metadata of the media stream. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2022-05-14T03:54:32Z","modified":"2023-02-03T05:00:52Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:52:51.988629Z"}],"nvd":[{"id":"CVE-2017-3083","description":"Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the Primetime SDK functionality related to the profile metadata of the media stream. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-06-20T17:29:00.393Z","modified":"2026-06-17T01:17:28.823Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:50.782497Z"}],"osv":[{"id":"RHSA-2017:1439","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T13:37:59Z","modified":"2026-06-29T10:16:28Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-3083","description":"Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the Primetime SDK functionality related to the profile metadata of the media stream. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2017-06-20T17:29:00Z","modified":"2025-07-16T07:36:39.643196Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2017-0172","title":"Updated flash-player-plugin packages fix security vulnerabilities","description":"Adobe Flash Player 26.0.0.126 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow\nan attacker to take control of the affected system.\n\nThis update resolves use-after-free vulnerabilities and memory\ncorruption vulnerabilities that could lead to code execution\n(CVE-2017-3075, CVE-2017-3081, CVE-2017-3083, CVE-2017-3084,\nCVE-2017-3076, CVE-2017-3077, CVE-2017-3078, CVE-2017-3079,\nCVE-2017-3082).\n","status":"published","published":"2017-06-14T13:50:35Z","modified":"2026-04-16T06:23:44.199417147Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}