Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code by using the actionCallMethod opcode with crafted arguments, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

Adobe reports :

These updates resolve integer overflow vulnerabilities that could lead to code execution (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000).

These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2016-1001).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, CVE-2016-1005).

Versions of Adobe AIR prior to 21.0.0.176 are outdated and thus unpatched for the following vulnerabilities :

 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992)
 - An integer overflow condition exists that is triggered as user-supplied input is not properly validated. This may potentially allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010)
 - A flaw exists that contains a use-after-free error and is triggered when handling the 'Sound.setTransform()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0987)
 - A flaw exists that contains a use-after-free error that is triggered when handling the 'setInterval()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0988)
 - A flaw exists and contains a use-after-free error that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0990, CVE-2016-0991)
 - A flaw exists that contains a use-after-free error that is triggered when manipulating arguments passed to the 'actionCallMethod' opcode. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0994)
 - A flaw exists that contains a use-after-free error that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0995)
 - A flaw exists that contains a use-after-free error in the 'setInterval()' method that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0996)
 - A flaw exists that contains a use-after-free error that is triggered when handling the 'MovieClip.swapDepths()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0997)
 - A flaw exists that contains a use-after-free error that is triggered when handling the 'Object.unwatch()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0998)
 - A flaw exists that contains a use-after-free error that is triggered when handling the 'AsBroadcaster.broadcastMessage()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0999)
 - A flaw exists that contains a use-after-free error that is triggered when creating sprites. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1000)
 - A flaw exists that contains an overflow condition in the 'zlib codecs' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow and potentially execute arbitrary code. (CVE-2016-1001)
 - A flaw exists that is triggered as user-supplied input is not properly validated when handling shape rendering. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1002)
 - A flaw exists that is triggered when handling a specially crafted MP4 file. This may allow a context-dependent attacker to dereference an uninitialized pointer and potentially execute arbitrary code. (CVE-2016-1005)

Versions of Adobe Flash Player prior to 21.0.0.182 are outdated and thus unpatched for the following vulnerabilities :

 - A flaw exists that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992)
 - An integer overflow condition exists that is triggered as user-supplied input is not properly validated. This may potentially allow a context-dependent attacker to execute arbitrary code. (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010)
 - A flaw exists that contains a use-after-free error and is triggered when handling the 'Sound.setTransform()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0987)
 - A flaw exists that contains a use-after-free error that is triggered when handling the 'setInterval()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0988)
 - A flaw exists and contains a use-after-free error that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0990, CVE-2016-0991)
 - A flaw exists that contains a use-after-free error that is triggered when manipulating arguments passed to the 'actionCallMethod' opcode. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0994)
 - A flaw exists that contains a use-after-free error that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0995)
 - A flaw exists that contains a use-after-free error in the 'setInterval()' method that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0996)
 - A flaw exists that contains a use-after-free error that is triggered when handling the 'MovieClip.swapDepths()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0997)
 - A flaw exists that contains a use-after-free error that is triggered when handling the 'Object.unwatch()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0998)
 - A flaw exists that contains a use-after-free error that is triggered when handling the 'AsBroadcaster.broadcastMessage()' method. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-0999)
 - A flaw exists that contains a use-after-free error that is triggered when creating sprites. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-1000)
 - A flaw exists that contains an overflow condition in the 'zlib codecs' that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow and potentially execute arbitrary code. (CVE-2016-1001)
 - A flaw exists that is triggered as user-supplied input is not properly validated when handling shape rendering. This may allow a context-dependent attacker to corrupt memory and potentially execute arbitrary code. (CVE-2016-1002)
 - A flaw exists that is triggered when handling a specially crafted MP4 file. This may allow a context-dependent attacker to dereference an uninitialized pointer and potentially execute arbitrary code. (CVE-2016-1005)

Adobe flash-player was updated to 11.2.202.577 to fix the following list of security issues (bsc#970547) :

These updates resolve integer overflow vulnerabilities that could lead to code execution (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000).

These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2016-1001).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, CVE-2016-1005).

Adobe advisory with more information:
https://helpx.adobe.com/security/products/flash-player/apsb16-08.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:0438 advisory.

    The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash     Player web browser plug-in.

    This update fixes multiple vulnerabilities in Adobe Flash Player. These     vulnerabilities, detailed in the Adobe Security Bulletin APSB16-08 listed     in the References section, could allow an attacker to create a specially     crafted SWF file that would cause flash-plugin to crash, execute arbitrary     code, or disclose sensitive information when the victim loaded a page     containing the malicious SWF content. (CVE-2016-0960, CVE-2016-0961,     CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987, CVE-2016-0988,     CVE-2016-0989, CVE-2016-0990, CVE-2016-0991, CVE-2016-0992, CVE-2016-0993,     CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998,     CVE-2016-0999, CVE-2016-1000, CVE-2016-1001, CVE-2016-1002, CVE-2016-1005,     CVE-2016-1010)

    All users of Adobe Flash Player should install this updated package, which     upgrades Flash Player to version 11.2.202.577.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update to Adobe Flash Player 11.2.202.577 fixes a number of vulnerabilities that could have allowed remote attackers to execute arbitrary code through crafted content. (boo#970547)

  - APSB16-08, CVE-2016-0960, CVE-2016-0961, CVE-2016-0962,     CVE-2016-0963, CVE-2016-0986, CVE-2016-0987,     CVE-2016-0988, CVE-2016-0989, CVE-2016-0990,     CVE-2016-0991, CVE-2016-0992, CVE-2016-0993,     CVE-2016-0994, CVE-2016-0995, CVE-2016-0996,     CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,     CVE-2016-1000, CVE-2016-1001, CVE-2016-1002,     CVE-2016-1005, CVE-2016-1010

The remote host is affected by the vulnerability described in GLSA-201603-07 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The version of Adobe Flash Player installed on the remote Mac OS X host is prior or equal to version 20.0.0.306. It is, therefore, affected by multiple vulnerabilities :

  - Multiple integer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2016-0963,     CVE-2016-0993, CVE-2016-1010)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-0987,     CVE-2016-0988, CVE-2016-0990, CVE-2016-0991,     CVE-2016-0994, CVE-2016-0995, CVE-2016-0996,     CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,     CVE-2016-1000)

  - A heap overflow condition exists that allows an attacker     to execute arbitrary code. (CVE-2016-1001)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-0960,     CVE-2016-0961, CVE-2016-0962, CVE-2016-0986,     CVE-2016-0989, CVE-2016-0992, CVE-2016-1002,     CVE-2016-1005)

The version of Adobe AIR installed on the remote Mac OS X host is prior or equal to version 20.0.0.260. It is, therefore, affected by multiple vulnerabilities :

  - Multiple integer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2016-0963,     CVE-2016-0993, CVE-2016-1010)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-0987,     CVE-2016-0988, CVE-2016-0990, CVE-2016-0991,     CVE-2016-0994, CVE-2016-0995, CVE-2016-0996,     CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,     CVE-2016-1000)

  - A heap overflow condition exists that allows an attacker     to execute arbitrary code. (CVE-2016-1001)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-0960,     CVE-2016-0961, CVE-2016-0962, CVE-2016-0986,     CVE-2016-0989, CVE-2016-0992, CVE-2016-1002,     CVE-2016-1005)

The version of Adobe AIR installed on the remote Windows host is prior or equal to version 20.0.0.260. It is, therefore, affected by multiple vulnerabilities :

  - Multiple integer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2016-0963,     CVE-2016-0993, CVE-2016-1010)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-0987,     CVE-2016-0988, CVE-2016-0990, CVE-2016-0991,     CVE-2016-0994, CVE-2016-0995, CVE-2016-0996,     CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,     CVE-2016-1000)

  - A heap overflow condition exists that allows an attacker     to execute arbitrary code. (CVE-2016-1001)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-0960,     CVE-2016-0961, CVE-2016-0962, CVE-2016-0986,     CVE-2016-0989, CVE-2016-0992, CVE-2016-1002,     CVE-2016-1005)

The remote Windows host is missing KB3144756. It is, therefore, affected by multiple vulnerabilities :

  - Multiple integer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2016-0963,     CVE-2016-0993, CVE-2016-1010)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-0987,     CVE-2016-0988, CVE-2016-0990, CVE-2016-0991,     CVE-2016-0994, CVE-2016-0995, CVE-2016-0996,     CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,     CVE-2016-1000)

  - A heap overflow condition exists that allows an attacker     to execute arbitrary code. (CVE-2016-1001)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-0960,     CVE-2016-0961, CVE-2016-0962, CVE-2016-0986,     CVE-2016-0989, CVE-2016-0992, CVE-2016-1002,     CVE-2016-1005)

The version of Adobe Flash Player installed on the remote Windows host is prior or equal to version 20.0.0.306. It is, therefore, affected by multiple vulnerabilities :

  - Multiple integer overflow conditions exist that allow an     attacker to execute arbitrary code. (CVE-2016-0963,     CVE-2016-0993, CVE-2016-1010)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-0987,     CVE-2016-0988, CVE-2016-0990, CVE-2016-0991,     CVE-2016-0994, CVE-2016-0995, CVE-2016-0996,     CVE-2016-0997, CVE-2016-0998, CVE-2016-0999,     CVE-2016-1000)

  - A heap overflow condition exists that allows an attacker     to execute arbitrary code. (CVE-2016-1001)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-0960,     CVE-2016-0961, CVE-2016-0962, CVE-2016-0986,     CVE-2016-0989, CVE-2016-0992, CVE-2016-1002,     CVE-2016-1005)

ID	Name	Product	Family	Severity
90292	FreeBSD : flash -- multiple vulnerabilities (f7b3d1eb-f738-11e5-a710-0011d823eebd)	Nessus	FreeBSD Local Security Checks	critical
9177	Adobe AIR < 21.0.0.176 Multiple Vulnerabilities (APSB16-08)	Nessus Network Monitor	Web Clients	critical
9176	Flash Player < 21.0.0.182 Multiple Vulnerabilities (APSB16-08)	Nessus Network Monitor	Web Clients	critical
89921	SUSE SLED11 Security Update : flash-player (SUSE-SU-2016:0716-1)	Nessus	SuSE Local Security Checks	critical
89920	SUSE SLED12 Security Update : flash-player (SUSE-SU-2016:0715-1)	Nessus	SuSE Local Security Checks	critical
89917	RHEL 5 / 6 : flash-plugin (RHSA-2016:0438)	Nessus	Red Hat Local Security Checks	high
89916	openSUSE Security Update : Adobe Flash Player (openSUSE-2016-335)	Nessus	SuSE Local Security Checks	critical
89908	openSUSE Security Update : Adobe Flash Player (openSUSE-2016-325)	Nessus	SuSE Local Security Checks	critical
89900	GLSA-201603-07 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
89870	Adobe Flash Player for Mac <= 20.0.0.306 Multiple Vulnerabilities (APSB16-08)	Nessus	MacOS X Local Security Checks	high
89869	Adobe AIR for Mac <= 20.0.0.260 Multiple Vulnerabilities (APSB16-08)	Nessus	MacOS X Local Security Checks	high
89868	Adobe AIR <= 20.0.0.260 Multiple Vulnerabilities (APSB16-08)	Nessus	Windows	high
89835	MS16-036: Security Update for Adobe Flash Player (3144756)	Nessus	Windows : Microsoft Bulletins	high
89834	Adobe Flash Player <= 20.0.0.306 Multiple Vulnerabilities (APSB16-08)	Nessus	Windows	high

Detections

Analytics

CVE-2016-0994

high

Tenable Plugins

critical

critical

critical

critical

critical

high

critical

critical

critical

high

high

high

high

high