Show vulnerabilities with patch / with exploit

Multiple vulnerabilities in Adobe Flash Player



Published: 2016-05-12 | Updated: 2017-02-13
Severity High
Patch available YES
Number of vulnerabilities 30
CVE ID CVE-2016-4163
CVE-2016-4162
CVE-2016-4161
CVE-2016-4160
CVE-2016-4120
CVE-2016-4115
CVE-2016-4114
CVE-2016-4113
CVE-2016-4112
CVE-2016-4111
CVE-2016-4109
CVE-2016-1104
CVE-2016-1102
CVE-2016-1100
CVE-2016-1099
CVE-2016-1098
CVE-2016-1096
CVE-2016-4116
CVE-2016-1103
CVE-2016-1101
CVE-2016-4121
CVE-2016-4110
CVE-2016-4108
CVE-2016-1110
CVE-2016-1109
CVE-2016-1108
CVE-2016-1107
CVE-2016-1106
CVE-2016-1097
CVE-2016-1105
CWE ID CWE-119
CWE-426
CWE-843
Exploitation vector Network
Public exploit Public exploit code for vulnerability #12 is available.
Public exploit code for vulnerability #13 is available.
Public exploit code for vulnerability #17 is available.
Public exploit code for vulnerability #19 is available.
Public exploit code for vulnerability #20 is available.
Public exploit code for vulnerability #23 is available.
Public exploit code for vulnerability #28 is available.
Public exploit code for vulnerability #30 is available.
Vulnerable software
Subscribe
Adobe Flash Player
Client/Desktop applications / Plugins for browsers, ActiveX components

Adobe AIR
Client/Desktop applications / Multimedia software

Adobe Flash Player for Linux
Client/Desktop applications / Multimedia software

Adobe Flash Player Extended Support Release
Client/Desktop applications / Multimedia software

Vendor Adobe

Security Advisory

1) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4163

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4162

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4161

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4160

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4120

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4115

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4114

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4113

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4112

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4111

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4109

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Memory corruption

Severity: High

CVSSv3: 8.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1104

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

13) Memory corruption

Severity: High

CVSSv3: 8.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1102

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

14) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1100

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1099

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Memory corruption

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1098

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Memory corruption

Severity: High

CVSSv3: 8.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1096

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

18) Untrusted search path

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4116

CWE-ID: CWE-426 - Untrusted Search Path

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error in the directory search path used to find resources. A remote attacker can create a specially crafted .swf file, locate it on WebDav or SMB share, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Buffer overflow

Severity: High

CVSSv3: 8.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1103

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

20) Heap-based buffer overflow

Severity: High

CVSSv3: 8.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1101

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

21) “Use-after-free” error

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4121

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Use-after-free error

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4110

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Use-after-free error

Severity: High

CVSSv3: 8.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-4108

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

24) Use-after-free error

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1110

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Use-after-free error

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1109

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Use-after-free error

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1108

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Use-after-free error

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1107

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) “Use-after-free” error

Severity: High

CVSSv3: 8.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1106

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

29) “Use-after-free” error

Severity: High

CVSSv3: 8.3 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1097

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Type confusion

Severity: High

CVSSv3: 8.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2016-1105

CWE-ID: CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to type confusion error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability results in arbitrary code execution.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Adobe Flash Player: 20.0.0.228, 20.0.0.235, 20.0.0.267, 20.0.0.272, 20.0.0.286, 20.0.0.306, 21.0.0.182, 21.0.0.197, 21.0.0.213, 21.0.0.216, 21.0.0.226, 21.0.0.241, 21.0.0.242

Adobe AIR: 21.0.0.176, 21.0.0.198 , 21.0.0.215

Adobe Flash Player for Linux: 11.2.202.238, 11.2.202.261, 11.2.202.262, 11.2.202.270, 11.2.202.273, 11.2.202.327, 11.2.202.332, 11.2.202.335, 11.2.202.336, 11.2.202.341, 11.2.202.350, 11.2.202.356, 11.2.202.418, 11.2.202.424, 11.2.202.425, 11.2.202.429, 11.2.202.438, 11.2.202.438, 11.2.202.440, 11.2.202.440, 11.2.202.442, 11.2.202.451, 11.2.202.457, 11.2.202.466, 11.2.202.468, 11.2.202.481, 11.2.202.491, 11.2.202.535, 11.2.202.540, 11.2.202.554, 11.2.202.559, 11.2.202.569, 11.2.202.577, 11.2.202.616, 11.2.202.621

Adobe Flash Player Extended Support Release: 18.0.0.268, 18.0.0.324, 18.0.0.326, 18.0.0.329, 18.0.0.333, 18.0.0.343, 18.0.0.352

CPE External links

https://helpx.adobe.com/security/products/flash-player/apsb16-15.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.