#VU5721 Information disclosure in Adobe products - CVE-2016-4139 

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU5721

#VU5721 Information disclosure in Adobe products - CVE-2016-4139

Published: February 13, 2017 / Updated: March 6, 2017


Vulnerability identifier: #VU5721
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2016-4139
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Adobe Flash Player
Adobe Flash Player Extended Support Release
Adobe Flash Player for Linux
Software vendor:
Adobe

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to input validation error when processing .swf files. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, bypass the same-origin-policy and gain access to potentially sensitive data.

Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.

Remediation

Update your Flash Player to the latest version.

  • Adobe recommends users of the  Adobe Flash Player Desktop Runtime for Windows and Macintosh update to 22.0.0.192 via the update mechanism within the product when prompted [1], or by visiting the Adobe Flash Player Download Center.
  • Adobe recommends users of the Adobe Flash Player Extended Support Release should update to version 18.0.0.360 by visiting http://helpx.adobe.com/flash-player/kb/archived-flash-player-versions.html.
  • Adobe recommends users of Adobe Flash Player for Linux update to Adobe Flash Player 11.2.202.626 by visiting the Adobe Flash Player Download Center.
  • Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version, which will include Adobe Flash Player 22.0.0.192 for Windows, Macintosh, Linux and Chrome OS.
  • Adobe Flash Player installed with Microsoft Edge and Internet Explorer for Windows 10 and 8.1 will be automatically updated to the latest version, which will include Adobe Flash Player 22.0.0.192. 
  • Please visit the Flash Player Help page for assistance in installing Flash Player.

External links