CVE-2017-11213

Se ha descubierto un problema en Adobe Flash Player 27.0.0.183 y anteriores. Esta vulnerabilidad ocurre como resultado de un cálculo que lee datos más allá del final del búfer objetivo debido a un desbordamiento de enteros; el cálculo forma parte de la abstracción que crea una imagen bitmap transparente u opaca con un tamaño arbitrario. El uso de un puntero inválido (fuera de rango) durante el acceso a los campos de la estructura de datos interna provoca esta vulnerabilidad. Un ataque con éxito podría conducir a la exposición de datos sensibles.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the handling of BitmapData objects. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated object. An attacker can leverage this vulnerability to execute code under the context of the current process.

The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 27.0.0.187. Security Fix: This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content.