An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions. This vulnerability occurs as a result of a computation that reads data that is past the end of the target buffer; the computation is part of AdobePSDK metadata. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.

Versions of Adobe Flash Player prior to 27.0.0.187 are unpatched, and therefore affected by multiple vulnerabilities :

 - An invalid (out-of-range) pointer vulnerability exists offset during access of internal data structure fields. A successful attack can lead to sensitive data exposure. (CVE-2017-3112, CVE-2017-3114, CVE-2017-11213)
 - The mismatch between an old and a new object can provide an attacker with unintended memory access potentially leading to code corruption, control-flow hijack, or an information leak attack. Successful exploitation could lead to arbitrary code execution. (CVE-2017-11215, CVE-2017-11225)

The remote host is affected by the vulnerability described in GLSA-201711-13 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the referenced CVE identifiers and Adobe Security Bulletin       for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process.
  Workaround :

    There is no known workaround at this time.

Adobe reports :

- These updates resolve out-of-bounds read vulnerabilities that could lead to remote code execution (CVE-2017-3112, CVE-2017-3114, CVE-2017-11213).

- These updates resolve use after free vulnerabilities that could lead to remote code execution (CVE-2017-11215, CVE-2017-11225).

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:3222 advisory.

  - flash-plugin: multiple code execution issues fixed in APSB17-33 (CVE-2017-11213, CVE-2017-11215,     CVE-2017-11225, CVE-2017-3112, CVE-2017-3114)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update KB4048951. It is, therefore, affected by multiple remote code execution vulnerabilities in Adobe Flash Player.

The version of Adobe Flash Player installed on the remote macOS or Mac OSX host is equal or prior to version 27.0.0.183.
It is therefore affected by multiple remote code execution vulnerabilities.

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 27.0.0.183. It is therefore affected by multiple remote code execution vulnerabilities.

ID	Name	Product	Family	Severity
700427	Flash Player < 27.0.0.187 Multiple Vulnerabilities (APSB17-33)	Nessus Network Monitor	Web Clients	critical
104694	GLSA-201711-13 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
104647	FreeBSD : Flash Player -- multiple vulnerabilities (52f10525-caff-11e7-b590-6451062f0f7a)	Nessus	FreeBSD Local Security Checks	critical
104622	RHEL 6 : flash-plugin (RHSA-2017:3222)	Nessus	Red Hat Local Security Checks	critical
104547	KB4048951: Security update for Adobe Flash Player (November 2017)	Nessus	Windows : Microsoft Bulletins	critical
104545	Adobe Flash Player for Mac <= 27.0.0.183 (APSB17-33)	Nessus	MacOS X Local Security Checks	critical
104544	Adobe Flash Player <= 27.0.0.183 (APSB17-33)	Nessus	Windows	critical

Detections

Analytics

CVE-2017-3112

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical