8.8Alta
KEV
CVE-2016-7892Adobe Flash Player Use-After-Free Vulnerability
Explotación conocida — Adobe Flash Player Use-After-Free Vulnerability
CISA confirmó el 25.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 15.04.2022.
Acción requerida: The impacted product is end-of-life and should be disconnected if still in use. https://nvd.nist.gov/vuln/detail/CVE-2016-7892
Descripción
Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.
Debilidad (CWE):
CWE-416
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| adobe | flash player | ≤ 23.0.0.207 | |
| adobe | flash player desktop runtime | ≤ 23.0.0.207 | |
| — | Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier | Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier |
Referencias y parches
- SUSE-SU-2016:3148 vendor-advisoryBroken Link
- MS16-154 vendor-advisoryPatchThird Party Advisory
- GLSA-201701-17 vendor-advisoryThird Party Advisory
- 1037442 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- RHSA-2016:2947 vendor-advisoryThird Party Advisory
- https://helpx.adobe.com/security/products/flash-player/apsb16-39.html PatchVendor Advisory
- 94877 vdb-entryThird Party AdvisoryVDB Entry
- openSUSE-SU-2016:3160 vendor-advisoryBroken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7892 US Government Resource
Coincidencias CPE (NVD) (5)
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*≤ 23.0.0.207cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*≤ 23.0.0.207cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*≤ 23.0.0.207cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*≤ 23.0.0.207cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*≤ 11.2.202.644