Adobe Flash Player Use-After-Free Vulnerability

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-03-03
• EPSS: 25% chance of exploitation in the next 30 days (higher than 98% of CVEs)

[ Description ]Official description

Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.

CISA: Use-after-free vulnerability in Adobe Flash Player Windows and OS and Linux allows remote attackers to execute arbitrary code.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 24 Mar 2022): The impacted product is end-of-life and should be disconnected if still in use.

• Patch on docs.microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
• Patch on helpx.adobe.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• rhn.redhat.com/errata/RHSA-2016-2119.htmlThird Party Advisory
• www.securityfocus.com/bid/93861Third Party AdvisoryVDB Entry
• www.securitytracker.com/id/1037111Third Party AdvisoryVDB Entry
• docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-128PatchVendor Advisory
• helpx.adobe.com/security/products/flash-player/apsb16-36.htmlPatchVendor Advisory
• security.gentoo.org/glsa/201610-10Third Party Advisory
• security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.htmlThird Party Advisory
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource