CVE-2017-2998

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK API functionality related to timeline interactions. Successful exploitation could lead to arbitrary code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	Adobe Flash Player 24.0.0.221 and earlier.	Adobe Flash Player 24.0.0.221 and earlier.

References

http://rhn.redhat.com/errata/RHSA-2017-0526.htmlThird Party Advisory
http://www.securityfocus.com/bid/96866Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037994Broken Link, Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/flash-player/apsb17-07.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201703-02Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0526.htmlThird Party Advisory
http://www.securityfocus.com/bid/96866Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037994Broken Link, Third Party Advisory, VDB Entry
https://helpx.adobe.com/security/products/flash-player/apsb17-07.htmlPatch, Vendor Advisory
https://security.gentoo.org/glsa/201703-02Third Party Advisory

Timeline

Published: Mar 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-29998.8Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable memory corruption vulnerability in the Primetime TVSDK functionality CVE-2017-30006.5Adobe Flash Player versions 24.0.0.221 and earlier have a vulnerability in the random number generator used for constant blinding. Successfu CVE-2017-30018.8Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability related to garbage collection in the Act CVE-2017-30028.8Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability in the ActionScript2 TextField object re CVE-2017-30038.8Adobe Flash Player versions 24.0.0.221 and earlier have an exploitable use after free vulnerability related to an interaction between the pr CVE-2017-30047.8Adobe Photoshop versions CC 2017 (18.0.1) and earlier, CC 2015.5.1 (17.0.1) and earlier have a memory corruption vulnerability when parsing CVE-2017-30057.8Adobe Photoshop versions CC 2017 (18.0.1) and earlier, CC 2015.5.1 (17.0.1) and earlier have an unquoted search path vulnerability.CVE-2017-30068.8Adobe Thor versions 3.9.5.353 and earlier have a vulnerability related to the use of improper resource permissions during the installation o CVE-2017-30077.8Adobe Thor versions 3.9.5.353 and earlier have a vulnerability in the directory search path used to find resources, related to Creative Clou CVE-2017-30086.1Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a reflected cross-CVE-2017-30097.5Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable buffer overflow vu CVE-2017-30109.8Adobe Acrobat Reader versions 15.020.20042 and earlier, 15.006.30244 and earlier, 11.0.18 and earlier have an exploitable memory corruption