critical9.8Known exploitedPublic exploit code
CVE-2016-4117
Adobe Flash Player Arbitrary Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-03. Federal due date: 2022-03-24.
The impacted product is end-of-life and should be disconnected if still in use.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Adobe Flash Player - DeleteRangeTimelineOperation Type Confusion (Metasploit)2019-02-11 · remote · osx · Verified
Impact
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adobe | Flash Player | through 21.0.0.226 |
| Redhat | Enterprise Linux Desktop | Versions 5.0, 6.0 |
| Redhat | Enterprise Linux Server | Versions 5.0, 6.0 |
| Redhat | Enterprise Linux Server From Rhui | Versions 5.0, 6.0 |
| Redhat | Enterprise Linux Workstation | Versions 5.0, 6.0 |
| Opensuse | Evergreen | Version 11.4 |
| Opensuse | Opensuse | Versions 13.1, 13.2 |
| Suse | Linux Enterprise Desktop | Version 12 |
| Suse | Linux Enterprise Workstation Extension | Version 12 |
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html
- http://rhn.redhat.com/errata/RHSA-2016-1079.html
- http://www.securityfocus.com/bid/90505
- http://www.securitytracker.com/id/1035826
- https://helpx.adobe.com/security/products/flash-player/apsa16-02.html
- https://helpx.adobe.com/security/products/flash-player/apsb16-15.html
- https://security.gentoo.org/glsa/201606-08
- https://www.exploit-db.com/exploits/46339/
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html
- http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html
- http://rhn.redhat.com/errata/RHSA-2016-1079.html
- http://www.securityfocus.com/bid/90505
- http://www.securitytracker.com/id/1035826
- https://helpx.adobe.com/security/products/flash-player/apsa16-02.html
- https://helpx.adobe.com/security/products/flash-player/apsb16-15.html
- https://security.gentoo.org/glsa/201606-08
- https://www.exploit-db.com/exploits/46339/
- https://github.com/cisagov/vulnrichment/issues/196
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4117