CVE-2016-7859: Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability

High severity · published Nov 8, 2016

CVE-2016-7859

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability

8.8

CVSS

EPSS

On KEV

Description

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)7.0% · higher than 94% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Enterprise Linux Desktop · Redhat

5.0; 6.0 · source: NVD

Enterprise Linux Server · Redhat

5.0; 6.0 · source: NVD

Enterprise Linux Workstation · Redhat

5.0; 6.0 · source: NVD

Flash Player · Adobe

through 23.0.0.205; through 23.0.0.205; through 23.0.0.205; through 23.0.0.205 · source: NVD

Flash Player For Linux · Adobe

through 11.2.202.643 · source: NVD

Affected product

Flash Player

Adobe

All Flash Player CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-7859

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-7859

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2676.html

Third Party Advisory

http://www.securityfocus.com/bid/94153

Third Party Advisory

http://www.securitytracker.com/id/1037240

Third Party Advisory

http://www.zerodayinitiative.com/advisories/ZDI-16-602

Patch

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-141

Patch

https://helpx.adobe.com/security/products/flash-player/apsb16-37.html