CVE-2017-3068: Use After Free
Adobe Flash Player versions 25.0.0.148 and earlier have an exploitable memory corruption vulnerability in the Advanced Video Coding engine. Successful exploitation could lead to arbitrary code execution.
Other sources
Adobe Security Bulletin APSB17-15 for Adobe Flash Player describes multiple flaws that can possibly lead to code execution when Flash Player is used to play a specially crafted SWF file.
Quoting from the APSB17-15:
These updates resolve a use-after-free vulnerability that could lead to code execution (CVE-2017-3071).
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2017-3068, CVE-2017-3069, CVE-2017-3070, CVE-2017-3072, CVE-2017-3073, CVE-2017-3074).
External References:
https://helpx.adobe.com/security/products/flash-player/apsb17-15.html
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-3068?
CVE-2017-3068 is classified as a critical vulnerability due to its potential for arbitrary code execution.
How do I fix CVE-2017-3068?
To fix CVE-2017-3068, update Adobe Flash Player to version 25.0.0.171 or later.
Which versions of Adobe Flash Player are affected by CVE-2017-3068?
CVE-2017-3068 affects Adobe Flash Player versions 25.0.0.148 and earlier.
What type of vulnerability is CVE-2017-3068?
CVE-2017-3068 is a memory corruption vulnerability found in the Advanced Video Coding engine of Adobe Flash Player.
What could happen if CVE-2017-3068 is exploited?
Successful exploitation of CVE-2017-3068 could lead to arbitrary code execution on the affected system.