CVE-2017-11225 Use after free in Adobe Flash Player 27.0.0.183 and earlier versions
A use-after-free flaw in Adobe Flash Player allows attackers to execute arbitrary code via crafted metadata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-11225?
CVE-2017-11225 is a critical use after free vulnerability in Adobe Flash Player, published on 9 Dec 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability is an instance of a use after free vulnerability in the Primetime SDK metadata functionality. The mismatch between an old and a new object can provide an attacker with unintended memory access -- potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution.
Weakness: CWE-416
Which versions are affected by CVE-2017-11225?
It affects 4 products.
Products include Adobe Flash Player, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2017-11225?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2017-11225 being exploited?
There is no known exploitation of CVE-2017-11225 in the wild and no public exploit code.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as CVE-2018-6059, GHSA-q7r5-p629-gmc5, UBUNTU-CVE-2017-11225.