Fortinet security researcher Kai Lu discovered and reported two critical zero-day vulnerabilities in Adobe Flash Player in November 2016. Adobe identified them as CVE-2017-2926 and CVE-2017-2927 and released a\u00a0patch\u00a0to fix them on January 10, 2017. Here is a brief summary of each of these detected vulnerabilities.<\/p>\n
CVE-2017-2926This is a memory corruption vulnerability found in Flash Player\u2019s engine when processing MP4 files. Specifically, the vulnerability is caused by a MP4 file with a crafted sample size in the MP4 atom specification that causes an out of bounds memory access, which sometimes triggers an access violation exception.<\/p>\n
Attackers can exploit the vulnerability by using the out of bounds access for unintended reads, writes, or frees — potentially leading to code corruption, control-flow hijack, or an information leak attack.<\/p>\n
Fortinet released IPS signature\u00a0Adobe.Flash.MP4.stsz.atom.Memory.Corruption\u00a0to proactively\u00a0protect our customers.<\/p>\n
CVE-2017-2927This is a heap overflow vulnerability that is exposed when processing Adobe Texture Format (ATF) files in Flash Player. Specifically, the vulnerability is caused by a malformed ATF file which causes an out of bounds memory access due to improper bounds checking when manipulating a pointer to a heap allocated buffer.<\/p>\n
Attackers can exploit this vulnerability by using the out of bounds access for unintended reads, writes, or frees — potentially leading to code corruption, control-flow hijack, or an information leak attack.<\/p>\n
Fortinet released IPS signature\u00a0Adobe.Flash.Adobe.Texture.Format.Heap.Overflow\u00a0to proactively\u00a0protect our customers.<\/p>\n","protected":false},"excerpt":{"rendered":"
Fortinet security researcher Kai Lu discovered and reported two critical zero-day vulnerabilities in Adobe Flash Player in November 2016. Adobe identified them as CVE-2017-2926 and CVE-2017-2927 and released a\u00a0patch\u00a0to fix them on January 10, 2017. Here is a brief summary of each of these detected vulnerabilities. CVE-2017-2926This is a memory corruption vulnerability found in Flash […]<\/p>\n","protected":false},"author":2,"featured_media":2474,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"1","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":0,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-4562","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n