HIGH KEV
flash-plugin: remote code execution vulnerability (APSB17-32)
Published Oct 21, 2017 ·Due Mar 24, 2022
8.8
HIGHCVSS 3.1
EPSS 11.88%
Description
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.
Affected products
- Vendor n/a Product Adobe Flash Player version 27.0.0.159 and earlier Defaultn/a
- Version Adobe Flash Player version 27.0.0.159 and earlierStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Adobe Flash Player version 27.0.0.159 and earlier | n/a |
|
Configuration 1
AND
- ≤ 27.0.0.159
Configuration 2
AND
OR
- ≤ 27.0.0.130
- ≤ 27.0.0.130
Running on/with
OR
- n/a
- n/a
Configuration 3
AND
- ≤ 27.0.0.159
Configuration 4
OR
- 6.0
- 6.0
- 6.0
No data.
Red Hat Enterprise Linux 6 Supplementary
flash-plugin-0:27.0.0.170-1.el6_9
Fixed · RHSA-2017:2899
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 Supplementary | flash-plugin-0:27.0.0.170-1.el6_9 | Fixed | RHSA-2017:2899 |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Metrics
No CVSS v4.0 score for this CVE.
8.8 HIGH NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
8.8 HIGH Red Hat
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality Impact High
Integrity Impact High
Availability Impact High
6.0 MEDIUM NVD
AV:N/AC:M/Au:S/C:P/I:P/A:P
Access Vector Network
Access Complexity Medium
Authentication Single
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial
Listed in CISA KEV KEV
Date Added
Mar 3, 2022
Patch Due
Mar 24, 2022
Required Action
The impacted product is end-of-life and should be disconnected if still in use.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
ActiveAutomatable
NoTechnical Impact
TotalDecision
n/aAssessed Feb 4, 2025 · SSVC 2.0.3
11.88% 0.11885
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
EPSS probability 0.11885
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (36 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 11.88% (0.11885) | 95.98th | v5 (v2026.06.15) |
| Jun 15, 2026 | 12.10% (0.12104) | 95.60th | v5 (v2026.06.15) |
| May 16, 2026 | 34.96% (0.34962) | 97.08th | v4 (v2025.03.14) |
| Apr 22, 2026 | 33.62% (0.33623) | 96.95th | v4 (v2025.03.14) |
| Apr 21, 2026 | 28.08% (0.28081) | 96.49th | v4 (v2025.03.14) |
| Apr 1, 2026 | 29.32% (0.29319) | 96.56th | v4 (v2025.03.14) |
| Dec 28, 2025 | 21.24% (0.21236) | 95.48th | v4 (v2025.03.14) |
| Dec 20, 2025 | 19.80% (0.19800) | 95.24th | v4 (v2025.03.14) |
| Oct 22, 2025 | 15.80% (0.15796) | 94.41th | v4 (v2025.03.14) |
| Mar 30, 2025 | 10.80% (0.10801) | 92.68th | v4 (v2025.03.14) |
| Mar 29, 2025 | 50.61% (0.50608) | 96.85th | v4 (v2025.03.14) |
| Mar 17, 2025 | 10.14% (0.10137) | 92.53th | v4 (v2025.03.14) |
| Feb 27, 2025 | 30.70% (0.30696) | 97.04th | v3 (v2023.03.01) |
| Dec 17, 2024 | 27.04% (0.27037) | 96.78th | v3 (v2023.03.01) |
| Dec 12, 2024 | 3.87% (0.03868) | 92.27th | v3 (v2023.03.01) |
| Jul 3, 2024 | 4.55% (0.04548) | 92.57th | v3 (v2023.03.01) |
| May 24, 2024 | 4.39% (0.04389) | 92.37th | v3 (v2023.03.01) |
| Apr 16, 2024 | 2.99% (0.02993) | 90.76th | v3 (v2023.03.01) |
| Jan 25, 2024 | 2.61% (0.02610) | 89.26th | v3 (v2023.03.01) |
| Oct 1, 2023 | 1.96% (0.01957) | 87.34th | v3 (v2023.03.01) |
| Aug 31, 2023 | 1.98% (0.01979) | 87.32th | v3 (v2023.03.01) |
| Jul 7, 2023 | 2.53% (0.02533) | 88.66th | v3 (v2023.03.01) |
| Jun 10, 2023 | 1.45% (0.01452) | 84.76th | v3 (v2023.03.01) |
| May 8, 2023 | 1.72% (0.01723) | 85.97th | v3 (v2023.03.01) |
| Apr 23, 2023 | 1.35% (0.01346) | 84.12th | v3 (v2023.03.01) |
| Mar 14, 2023 | 1.48% (0.01479) | 84.75th | v3 (v2023.03.01) |
| Mar 7, 2023 | 1.66% (0.01660) | 85.64th | v3 (v2023.03.01) |
| Mar 6, 2023 | 3.18% (0.03183) | 84.07th | v2 (v2022.01.01) |
| Jan 28, 2023 | 3.18% (0.03183) | 83.59th | v2 (v2022.01.01) |
| Jul 18, 2022 | 2.79% (0.02792) | 82.02th | v2 (v2022.01.01) |
| Apr 1, 2022 | 2.72% (0.02717) | 81.18th | v2 (v2022.01.01) |
| Feb 4, 2022 | 2.72% (0.02717) | 62.68th | v2 (v2022.01.01) |
| Feb 3, 2022 | 9.39% (0.09393) | 86.77th | v1 |
| Jan 6, 2022 | 9.39% (0.09393) | 86.62th | v1 |
| Sep 1, 2021 | 9.39% (0.09393) | 94.01th | v1 |
| Apr 14, 2021 | 9.39% (0.09393) | 0.00th | v1 |
Weaknesses (1)
References (11)
- http://www.securityfocus.com/bid/101286 vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039582 vdb-entryx_refsource_SECTRACKBroken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:2899 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2017-11292 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1502726 Issue Tracking
- https://helpx.adobe.com/security/products/flash-player/apsb17-32.html x_refsource_CONFIRMPatchVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2017-11292
- https://security.gentoo.org/glsa/201710-22 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 government-resourceUS Government Resource
- https://www.cve.org/CVERecord?id=CVE-2017-11292
| Link | Providers | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/101286 | vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry | |
| http://www.securitytracker.com/id/1039582 | vdb-entryx_refsource_SECTRACKBroken LinkThird Party AdvisoryVDB Entry | |
| https://access.redhat.com/errata/RHSA-2017:2899 | vendor-advisoryx_refsource_REDHATThird Party Advisory | |
| https://access.redhat.com/security/cve/CVE-2017-11292 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1502726 | Issue Tracking | |
| https://helpx.adobe.com/security/products/flash-player/apsb17-32.html | x_refsource_CONFIRMPatchVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2017-11292 | ||
| https://security.gentoo.org/glsa/201710-22 | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog | ||
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 | government-resourceUS Government Resource | |
| https://www.cve.org/CVERecord?id=CVE-2017-11292 |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner adobe
Published Oct 21, 2017
Updated Oct 21, 2025
Reserved Jul 13, 2017
Link CVE-2017-11292
CISA Vulnrichment
Updated Feb 4, 2025