CVE-2017-3075

Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability when manipulating the ActionsScript 2 XML class

published June 20, 2017

CVSS
—
EPSS
9%
Percentile
95.1
In the wild
Unconfirmed
What it is

⚠️ A crafty little bug hides in Adobe Flash Player, where a use after free vulnerability could let attackers run arbitrary code — like leaving the door to your digital house wide open! 🔥 Think of it like a restaurant that still serves a dish after someone’s returned it because they found a hair in it — the kitchen never checked, and now who knows what they’re cooking up next! If exploited, this vulnerability could allow attackers to execute any code they want on your system, potentially leading to a full-blown compromise. Your data, privacy, and security could be at risk in ways you never imagined!

Put simply

Think of it like a restaurant that still serves a dish after someone’s returned it because they found a hair in it — the kitchen never checked, and now who knows what they’re cooking up next! This vulnerability occurs when Flash Player mishandles the ActionsScript 2 XML class, allowing attackers to manipulate memory and execute arbitrary code after a free operation that should have removed the object from memory.

What to do

If exploited, this vulnerability could allow attackers to execute any code they want on your system, potentially leading to a full-blown compromise. Your data, privacy, and security could be at risk in ways you never imagined! To stay safe, it's crucial to upgrade your Adobe Flash Player to version 25.0.0.172 or later. Additionally, consider disabling Flash in your browsers if you don't need it, as it’s becoming increasingly obsolete and a security risk. You've got this! With these steps, you'll keep your system secure and ready to thwart any rogue code. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08719 · 95.1th percentile
Published
2017-06-20T17:00Z
EPSS history
Timeline
  • 20 JUN 17:00Z
    Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability when manipulating the ActionsScript 2 XML class
    cvelistv5