CVE-2017-11292

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-11292
Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.securityfocus.com/bid/101286 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039582 Broken Link Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:2899 Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb17-32.html Patch Vendor Advisory
https://security.gentoo.org/glsa/201710-22 Third Party Advisory
http://www.securityfocus.com/bid/101286 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039582 Broken Link Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:2899 Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb17-32.html Patch Vendor Advisory
https://security.gentoo.org/glsa/201710-22 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*
OR cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
History

22 Oct 2025, 00:16

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 -

21 Oct 2025, 20:16

Type Values Removed Values Added
References
  • {'url': 'https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292', 'source': '134c704f-9b21-4f2e-91b3-4a467353bcc0'}

21 Oct 2025, 19:17

Type Values Removed Values Added
References
  • () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11292 -

21 Nov 2024, 03:07

Type Values Removed Values Added
References () http://www.securityfocus.com/bid/101286 - Broken Link, Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/101286 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1039582 - Broken Link, Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1039582 - Broken Link, Third Party Advisory, VDB Entry
References () https://access.redhat.com/errata/RHSA-2017:2899 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2017:2899 - Third Party Advisory
References () https://helpx.adobe.com/security/products/flash-player/apsb17-32.html - Patch, Vendor Advisory () https://helpx.adobe.com/security/products/flash-player/apsb17-32.html - Patch, Vendor Advisory
References () https://security.gentoo.org/glsa/201710-22 - Third Party Advisory () https://security.gentoo.org/glsa/201710-22 - Third Party Advisory

18 Apr 2022, 17:55

Type Values Removed Values Added
CPE cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
CWE CWE-129 CWE-843
References (SECTRACK) http://www.securitytracker.com/id/1039582 - Third Party Advisory, VDB Entry (SECTRACK) http://www.securitytracker.com/id/1039582 - Broken Link
References (BID) http://www.securityfocus.com/bid/101286 - Third Party Advisory, VDB Entry (BID) http://www.securityfocus.com/bid/101286 - Broken Link
References (REDHAT) https://access.redhat.com/errata/RHSA-2017:2899 - (REDHAT) https://access.redhat.com/errata/RHSA-2017:2899 - Third Party Advisory

22 Sep 2021, 14:25

Type Values Removed Values Added
CPE cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:* cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
Information

Published : 2017-10-22 19:29

Updated : 2025-10-22 00:16

NVD link : CVE-2017-11292

Mitre link : CVE-2017-11292

CVE.ORG link : CVE-2017-11292

JSON object : View

Products Affected

microsoft

  • windows_10
  • windows_8.1
  • windows

apple

  • mac_os_x

redhat

  • enterprise_linux_desktop
  • enterprise_linux_workstation
  • enterprise_linux_server

google

  • chrome_os

adobe

  • flash_player
  • flash_player_desktop_runtime

linux

  • linux_kernel
CWE
CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')