{"id":"CVE-2017-3100","aliases":["EUVD-2017-12241","GHSA-8r6j-26f6-55cv","MGASA-2017-0211","RHSA-2017:1731","UBUNTU-CVE-2017-3100"],"status":"published","title":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption...","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03748,"percentile":0.89945,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-787"],"published":"2017-07-14T05:00:00Z","modified":"2026-06-29T10:16:53Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["26.0.0.137ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","fixed_in":["26.0.0.137ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.137-1.mga5.nonfree"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.137-1.1.mga6.nonfree"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:26.0.0.137-1.el6_9"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.137ubuntu0.14.04.1"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.2","11.2.202.491ubuntu0.14.04.1","11.2.202.508ubuntu0.14.04.1","11.2.202.521ubuntu0.14.04.1","11.2.202.535ubuntu0.14.04.1","11.2.202.540ubuntu0.14.04.2","11.2.202.548ubuntu0.14.04.1","11.2.202.554ubuntu0.14.04.1","11.2.202.559ubuntu0.14.04.1","11.2.202.569ubuntu0.14.04.1","11.2.202.577ubuntu0.14.04.1","11.2.202.616ubuntu0.14.04.1","11.2.202.621ubuntu0.14.04.1","11.2.202.626ubuntu0.14.04.1","11.2.202.632ubuntu0.14.04.1","11.2.202.635ubuntu0.14.04.1","11.2.202.637ubuntu0.14.04.1","11.2.202.643ubuntu0.14.04.1","11.2.202.644ubuntu0.14.04.1","24.0.0.186ubuntu0.14.04.1","24.0.0.194ubuntu0.14.04.1","24.0.0.221ubuntu0.14.04.1","25.0.0.127ubuntu0.14.04.1","25.0.0.148ubuntu0.14.04.1","25.0.0.171ubuntu0.14.04.1","26.0.0.126ubuntu0.14.04.1","26.0.0.131ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.0.0.137ubuntu0.16.04.1"}]}],"versions":["11.2.202.540ubuntu2","11.2.202.548ubuntu1","11.2.202.554ubuntu1","11.2.202.559ubuntu1","11.2.202.569ubuntu1","11.2.202.577ubuntu1","11.2.202.616ubuntu1","11.2.202.621ubuntu0.16.04.1","11.2.202.626ubuntu0.16.04.1","11.2.202.632ubuntu0.16.04.1","11.2.202.635ubuntu0.16.04.1","11.2.202.637ubuntu0.16.04.1","11.2.202.643ubuntu0.16.04.1","11.2.202.644ubuntu0.16.04.1","24.0.0.186ubuntu0.16.04.1","24.0.0.194ubuntu0.16.04.1","24.0.0.221ubuntu0.16.04.1","25.0.0.127ubuntu0.16.04.1","25.0.0.148ubuntu0.16.04.1","25.0.0.171ubuntu0.16.04.1","26.0.0.126ubuntu0.16.04.1","26.0.0.131ubuntu0.16.04.1"]}],"products":[{"vendor":"adobe","product":"flash_player"},{"vendor":"adobe","product":"flash_player_desktop_runtime"}],"references":[{"url":"http://www.securitytracker.com/id/1038845","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","report"]},{"url":"http://www.securityfocus.com/bid/99523","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1731","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb17-21.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","web","article","report"]},{"url":"https://security.gentoo.org/glsa/201707-15","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3100","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8r6j-26f6-55cv"},{"url":"https://advisories.mageia.org/MGASA-2017-0211.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21224","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469763","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1731.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3080","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3080","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3099","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3099","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-3099","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-3100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-3100","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2017-3100","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-3100","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure.","status":"published","published":"2017-07-14T05:00:00Z","modified":"2024-08-05T14:16:27.912Z","updated_at":"2026-11-02T14:33:15.887816Z"}],"euvd":[{"id":"EUVD-2017-12241","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure.","status":"published","published":"2017-07-14T05:00:00Z","modified":"2024-08-05T14:16:27Z","updated_at":"2026-11-03T02:39:19.04602Z"}],"ghsa":[{"id":"GHSA-8r6j-26f6-55cv","title":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption...","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure.","status":"published","published":"2022-05-13T01:04:51Z","modified":"2023-01-27T21:31:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:43:22.817498Z"}],"nvd":[{"id":"CVE-2017-3100","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure.","status":"published","published":"2017-07-17T13:18:26.203Z","modified":"2026-06-17T01:17:30.843Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:54.012105Z"}],"osv":[{"id":"RHSA-2017:1731","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T13:38:44Z","modified":"2026-06-29T10:16:53Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-3100","description":"Adobe Flash Player versions 26.0.0.131 and earlier have an exploitable memory corruption vulnerability in the Action Script 2 BitmapData class. Successful exploitation could lead to memory address disclosure.","status":"published","published":"2017-07-17T13:18:00Z","modified":"2025-07-16T07:36:39.841022Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2017-0211","title":"Updated flash-player-plugin packages fix security vulnerability","description":"Adobe Flash Player 26.0.0.137 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow an\nattacker to take control of the affected system.\n\nThis update resolves security bypass and memory corruption vulnerabilities\nthat could lead to information disclosure or code execution\n(CVE-2017-3080, CVE-2017-3099, CVE-2017-3100).\n","status":"published","published":"2017-07-22T08:42:57Z","modified":"2026-04-16T06:25:23.054622242Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}