CVE-2016-7861: Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability

High severity · published Nov 8, 2016

CVE-2016-7861

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability

8.8

CVSS

7.3%

EPSS

On KEV

Description

Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)7.3% · higher than 94% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Enterprise Linux Desktop · Redhat

5.0; 6.0 · source: NVD

Enterprise Linux Server · Redhat

5.0; 6.0 · source: NVD

Enterprise Linux Workstation · Redhat

5.0; 6.0 · source: NVD

Flash Player · Adobe

through 23.0.0.205; through 23.0.0.205; through 23.0.0.205; through 23.0.0.205 · source: NVD

Flash Player For Linux · Adobe

through 11.2.202.643 · source: NVD

Affected product

Flash Player

Adobe

All Flash Player CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2016-7861

CVE.org

https://www.cve.org/CVERecord?id=CVE-2016-7861

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-2676.html

Third Party Advisory

http://www.securityfocus.com/bid/94151

Third Party Advisory

http://www.securitytracker.com/id/1037240

Third Party Advisory

http://www.zerodayinitiative.com/advisories/ZDI-16-600

Patch

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-141

Patch

https://helpx.adobe.com/security/products/flash-player/apsb16-37.html