Flash Player < 26.0.0.126 Multiple RCE (APSB17-17)

Versions of Adobe Flash Player prior to 26.0.0.126 are unpatched, and therefore affected by the following RCE vulnerabilities :

• A use-after-free error exists in the XML Load method. The issue is triggered when handling XML objects. With a specially crafted file, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (CVE-2017-3075)
• A flaw exists that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code. (CVE-2017-3076, CVE-2017-3077, CVE-2017-3078, CVE-2017-3079)
• A use-after-free error exists that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. No further details have been provided. (CVE-2017-3081)
• A flaw exists that is triggered as LocaleID determinePreferredLocales metadata objects are not properly validated. This may allow a context-dependent attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code. (CVE-2017-3082)
• A use-after-free error exists during profile object handling. With a specially crafted file, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (CVE-2017-3083)
• A use-after-free error exists during the cloning of AuditudeSettings objects. With a specially crafted file, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (CVE-2017-3084)