Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.

Adobe reports :

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-1105, CVE-2016-4117).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, CVE-2016-4110, CVE-2016-4121).

These updates resolve a heap buffer overflow vulnerability that could lead to code execution (CVE-2016-1101).

These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2016-1103).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, CVE-2016-4162, CVE-2016-4163).

These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-4116).

The version of Google Chrome installed on the remote host is prior to 50.0.2661.102, and is affected by multiple vulnerabilities :

 - A same-origin bypass vulnerability exists in DOM due to scripts being permitted run while a node is being adopted.  A context-dependent attacker can exploit this to bypass the same-origin policy. (CVE-2016-1667)
 - A same-origin bypass vulnerability exists due to a flaw in the Blink V8 bindings.  A context-dependent attacker can exploit this to bypass the same-origin policy. (CVE-2016-1668)
 - An overflow condition exists in V8 due to improper validation of user-supplied input.  A context-dependent attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-1669)
 - A race condition exists in the loader related to the use of ids.  An attacker can exploit this to have an unspecified impact. (CVE-2016-1670)

The following vulnerabilities affect the bundled version of Flash Player in Chrome :

 - Multiple type confusion errors exist that allow an attacker to execute arbitrary code. (CVE-2016-1105, CVE-2016-4117)
 - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, CVE-2016-4110, CVE-2016-4121)
 - A heap buffer overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2016-1101)
 - An unspecified buffer overflow exists that allows an attacker to execute arbitrary code. (CVE-2016-1103)
 - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)
 - A flaw exists when loading dynamic-link libraries.  An attacker can exploit this, via a specially crafted .dll file, to execute arbitrary code. (CVE-2016-4116)

Versions of Adobe Flash Player prior to 11.2.202.621, 18.0.0.352, or 21.0.0.242 are outdated and thus unpatched for the following vulnerabilities :

 - Multiple type confusion errors exist that allow an attacker to execute arbitrary code. (CVE-2016-1105, CVE-2016-4117)
 - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, CVE-2016-4110, CVE-2016-4121)
 - A heap buffer overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2016-1101)
 - An unspecified buffer overflow exists that allows an attacker to execute arbitrary code. (CVE-2016-1103)
 - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)
 - A flaw exists when loading dynamic-link libraries. An attacker can exploit this, via a specially crafted '.dll' file, to execute arbitrary code. (CVE-2016-4116)

This update for flash-player fixes the following issues :

  - Security update to 11.2.202.621 (bsc#979422) :

  - APSA16-02, APSB16-15, CVE-2016-1096, CVE-2016-1097,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1101, CVE-2016-1102, CVE-2016-1103,     CVE-2016-1104, CVE-2016-1105, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4109,     CVE-2016-4110, CVE-2016-4111, CVE-2016-4112,     CVE-2016-4113, CVE-2016-4114, CVE-2016-4115,     CVE-2016-4116, CVE-2016-4117

  - The following CVEs got fixed during the previous     release, but got published afterwards :

  - APSA16-01, APSB16-10, CVE-2016-1006, CVE-2016-1011,     CVE-2016-1012, CVE-2016-1013, CVE-2016-1014,     CVE-2016-1015, CVE-2016-1016, CVE-2016-1017,     CVE-2016-1018, CVE-2016-1019, CVE-2016-1020,     CVE-2016-1021, CVE-2016-1022, CVE-2016-1023,     CVE-2016-1024, CVE-2016-1025, CVE-2016-1026,     CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,     CVE-2016-1030, CVE-2016-1031, CVE-2016-1032,     CVE-2016-1033

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to 21.0.0.226. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

The version of Adobe AIR installed on the remote Mac OS X host is prior or equal to version 21.0.0.198. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to 21.0.0.226. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

The version of Adobe AIR installed on the remote Windows host is prior or equal to version 21.0.0.198. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:1079 advisory.

    The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

    This update upgrades Flash Player to version 11.2.202.621.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the     Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially     crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive     information when the victim loaded a page containing the malicious SWF content. (CVE-2016-1096,     CVE-2016-1097, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1101, CVE-2016-1102, CVE-2016-1103,     CVE-2016-1104, CVE-2016-1105, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110,     CVE-2016-4108, CVE-2016-4109, CVE-2016-4110, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4116, CVE-2016-4117)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Mac OS X host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in DOM due to     scripts being permitted run while a node is being     adopted. A context-dependent attacker can exploit this     to bypass the same-origin policy. (CVE-2016-1667)

  - A same-origin bypass vulnerability exists due to a flaw     in the Blink V8 bindings. A context-dependent attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1668)

  - An overflow condition exists in V8 due to improper     validation of user-supplied input. A context-dependent     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1669)

  - A race condition exists in the loader related to the use     of ids. An attacker can exploit this to have an     unspecified impact. (CVE-2016-1670)

  - Multiple type confusion errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1105, CVE-2016-4117)

  - Multiple use-after-free errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1097, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4110,     CVE-2016-4121)

  - A heap buffer overflow condition exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1096, CVE-2016-1098,     CVE-2016-1099, CVE-2016-1100, CVE-2016-1102,     CVE-2016-1104, CVE-2016-4109, CVE-2016-4111,     CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4120, CVE-2016-4160,     CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)

  - A flaw exists in the bundled version of Adobe Flash when     loading dynamic-link libraries. An attacker can exploit     this, via a specially crafted .dll file, to execute     arbitrary code. (CVE-2016-4116)

The version of Google Chrome installed on the remote Windows host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in DOM due to     scripts being permitted run while a node is being     adopted. A context-dependent attacker can exploit this     to bypass the same-origin policy. (CVE-2016-1667)

  - A same-origin bypass vulnerability exists due to a flaw     in the Blink V8 bindings. A context-dependent attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1668)

  - An overflow condition exists in V8 due to improper     validation of user-supplied input. A context-dependent     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1669)

  - A race condition exists in the loader related to the use     of ids. An attacker can exploit this to have an     unspecified impact. (CVE-2016-1670)

  - Multiple type confusion errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1105, CVE-2016-4117)

  - Multiple use-after-free errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1097, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4110,     CVE-2016-4121)

  - A heap buffer overflow condition exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1096, CVE-2016-1098,     CVE-2016-1099, CVE-2016-1100, CVE-2016-1102,     CVE-2016-1104, CVE-2016-4109, CVE-2016-4111,     CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4120, CVE-2016-4160,     CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)

  - A flaw exists in the bundled version of Adobe Flash when     loading dynamic-link libraries. An attacker can exploit     this, via a specially crafted .dll file, to execute     arbitrary code. (CVE-2016-4116)

The remote Windows host is missing KB3163207. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

Note: KB3163207 replaces KB3157993 which did not address CVE-2016-4117.

ID	Name	Product	Family	Severity
91697	FreeBSD : flash -- multiple vulnerabilities (0c6b008d-35c4-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical
9371	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
9354	Flash Player < 11.2.202.621 / 18.0.0.352 / 21.0.0.242 Multiple Vulnerabilities (APSB16-15)	Nessus Network Monitor	Web Clients	critical
91217	SUSE SLED12 Security Update : flash-player (SUSE-SU-2016:1305-1)	Nessus	SuSE Local Security Checks	critical
91165	Adobe Flash Player for Mac <= 21.0.0.226 Multiple Vulnerabilities (APSB16-15)	Nessus	MacOS X Local Security Checks	critical
91164	Adobe AIR for Mac <= 21.0.0.198 Multiple Vulnerabilities (APSB16-15)	Nessus	MacOS X Local Security Checks	critical
91163	Adobe Flash Player <= 21.0.0.226 Multiple Vulnerabilities (APSB16-15)	Nessus	Windows	critical
91162	Adobe AIR <= 21.0.0.198 Multiple Vulnerabilities (APSB16-15)	Nessus	Windows	critical
91156	RHEL 5 / 6 : flash-plugin (RHSA-2016:1079)	Nessus	Red Hat Local Security Checks	critical
91129	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
91128	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities	Nessus	Windows	critical
91013	MS16-064: Security Update for Adobe Flash Player (3163207)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2016-1096

high

Tenable Plugins

critical

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical