8.8High
KEV
CVE-2016-7892Adobe Flash Player Use-After-Free Vulnerability
Known exploited — Adobe Flash Player Use-After-Free Vulnerability
CISA confirmed this vulnerability is used in real attacks on 25.03.2022. Remediation deadline for US federal agencies: 15.04.2022.
Required action: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2016-7892
Description
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.
Weakness (CWE):
CWE-416
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| adobe | flash player | ≤ 23.0.0.207 | |
| adobe | flash player desktop runtime | ≤ 23.0.0.207 | |
| — | Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier | Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier |
References and patches
- SUSE-SU-2016:3148 vendor-advisoryBroken Link
- MS16-154 vendor-advisoryPatchThird Party Advisory
- GLSA-201701-17 vendor-advisoryThird Party Advisory
- 1037442 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- RHSA-2016:2947 vendor-advisoryThird Party Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb16-39.html PatchVendor Advisory
- 94877 vdb-entryThird Party AdvisoryVDB Entry
- openSUSE-SU-2016:3160 vendor-advisoryBroken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7892 US Government Resource
CPE matches (NVD) (5)
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*≤ 23.0.0.207cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*≤ 23.0.0.207cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*≤ 23.0.0.207cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*≤ 23.0.0.207cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*≤ 11.2.202.644