[ CVE-2016-4117 · Published 11 May 2016 ]
Adobe Flash Player Arbitrary Code Execution Vulnerability
Exploited · CISA KEV CVSS 9.8
EPSS 94%No fix listed yet
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-03
- Known to be used in ransomware campaigns
- EPSS: 94% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CISA: An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 24 Mar 2022): The impacted product is end-of-life and should be disconnected if still in use.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.htmlMailing ListThird Party Advisory
- rhn.redhat.com/errata/RHSA-2016-1079.htmlThird Party Advisory
- www.securityfocus.com/bid/90505Broken LinkThird Party AdvisoryVDB Entry
- www.securitytracker.com/id/1035826Broken LinkThird Party AdvisoryVDB Entry
- helpx.adobe.com/security/products/flash-player/apsa16-02.htmlBroken LinkVendor Advisory
- helpx.adobe.com/security/products/flash-player/apsb16-15.htmlBroken Link
- security.gentoo.org/glsa/201606-08Third Party Advisory
- www.exploit-db.com/exploits/46339ExploitThird Party AdvisoryVDB Entry
- github.com/cisagov/vulnrichment/issues/196Issue Tracking
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource