Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

The remote host is affected by the vulnerability described in GLSA-201606-08 (Adobe Flash Player: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Adobe Flash Player.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Adobe reports :

These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-1105, CVE-2016-4117).

These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, CVE-2016-4110, CVE-2016-4121).

These updates resolve a heap buffer overflow vulnerability that could lead to code execution (CVE-2016-1101).

These updates resolve a buffer overflow vulnerability that could lead to code execution (CVE-2016-1103).

These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, CVE-2016-4162, CVE-2016-4163).

These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-4116).

Versions of Adobe Flash Player prior to 11.2.202.621, 18.0.0.352, or 21.0.0.242 are outdated and thus unpatched for the following vulnerabilities :

 - Multiple type confusion errors exist that allow an attacker to execute arbitrary code. (CVE-2016-1105, CVE-2016-4117)
 - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2016-1097, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110, CVE-2016-4108, CVE-2016-4110, CVE-2016-4121)
 - A heap buffer overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2016-1101)
 - An unspecified buffer overflow exists that allows an attacker to execute arbitrary code. (CVE-2016-1103)
 - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2016-1096, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1102, CVE-2016-1104, CVE-2016-4109, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114, CVE-2016-4115, CVE-2016-4120, CVE-2016-4160, CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)
 - A flaw exists when loading dynamic-link libraries. An attacker can exploit this, via a specially crafted '.dll' file, to execute arbitrary code. (CVE-2016-4116)

This update for flash-player fixes the following issues :

  - Security update to 11.2.202.621 (bsc#979422) :

  - APSA16-02, APSB16-15, CVE-2016-1096, CVE-2016-1097,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1101, CVE-2016-1102, CVE-2016-1103,     CVE-2016-1104, CVE-2016-1105, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4109,     CVE-2016-4110, CVE-2016-4111, CVE-2016-4112,     CVE-2016-4113, CVE-2016-4114, CVE-2016-4115,     CVE-2016-4116, CVE-2016-4117

  - The following CVEs got fixed during the previous     release, but got published afterwards :

  - APSA16-01, APSB16-10, CVE-2016-1006, CVE-2016-1011,     CVE-2016-1012, CVE-2016-1013, CVE-2016-1014,     CVE-2016-1015, CVE-2016-1016, CVE-2016-1017,     CVE-2016-1018, CVE-2016-1019, CVE-2016-1020,     CVE-2016-1021, CVE-2016-1022, CVE-2016-1023,     CVE-2016-1024, CVE-2016-1025, CVE-2016-1026,     CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,     CVE-2016-1030, CVE-2016-1031, CVE-2016-1032,     CVE-2016-1033

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This security update for flash-player to 11.2.202.621 fixes the following issues (boo#979422) :

A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. (APSA16-02)

https://helpx.adobe.com/security/products/flash-player/apsa16-02.html

This security update for flash-player to 11.2.202.621 fixes the following issues (boo#979422) :

A critical vulnerability (CVE-2016-4117) exists in Adobe Flash Player 21.0.0.226 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system. (APSA16-02)

https://helpx.adobe.com/security/products/flash-player/apsa16-02.html

Some CVEs were not listed in the last submission :

  - APSA16-01, APSB16-10, CVE-2016-1006, CVE-2016-1011,     CVE-2016-1012, CVE-2016-1013, CVE-2016-1014,     CVE-2016-1015, CVE-2016-1016, CVE-2016-1017,     CVE-2016-1018, CVE-2016-1019, CVE-2016-1020,     CVE-2016-1021, CVE-2016-1022, CVE-2016-1023,     CVE-2016-1024, CVE-2016-1025, CVE-2016-1026,     CVE-2016-1027, CVE-2016-1028, CVE-2016-1029,     CVE-2016-1030, CVE-2016-1031, CVE-2016-1032,     CVE-2016-1033

The version of Adobe Flash Player installed on the remote Mac OS X host is equal or prior to 21.0.0.226. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

The version of Adobe AIR installed on the remote Mac OS X host is prior or equal to version 21.0.0.198. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to 21.0.0.226. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

The version of Adobe AIR installed on the remote Windows host is prior or equal to version 21.0.0.198. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:1079 advisory.

    The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in.

    This update upgrades Flash Player to version 11.2.202.621.

    Security Fix(es):

    * This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the     Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially     crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive     information when the victim loaded a page containing the malicious SWF content. (CVE-2016-1096,     CVE-2016-1097, CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1101, CVE-2016-1102, CVE-2016-1103,     CVE-2016-1104, CVE-2016-1105, CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109, CVE-2016-1110,     CVE-2016-4108, CVE-2016-4109, CVE-2016-4110, CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4116, CVE-2016-4117)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Mac OS X host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in DOM due to     scripts being permitted run while a node is being     adopted. A context-dependent attacker can exploit this     to bypass the same-origin policy. (CVE-2016-1667)

  - A same-origin bypass vulnerability exists due to a flaw     in the Blink V8 bindings. A context-dependent attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1668)

  - An overflow condition exists in V8 due to improper     validation of user-supplied input. A context-dependent     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1669)

  - A race condition exists in the loader related to the use     of ids. An attacker can exploit this to have an     unspecified impact. (CVE-2016-1670)

  - Multiple type confusion errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1105, CVE-2016-4117)

  - Multiple use-after-free errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1097, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4110,     CVE-2016-4121)

  - A heap buffer overflow condition exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1096, CVE-2016-1098,     CVE-2016-1099, CVE-2016-1100, CVE-2016-1102,     CVE-2016-1104, CVE-2016-4109, CVE-2016-4111,     CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4120, CVE-2016-4160,     CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)

  - A flaw exists in the bundled version of Adobe Flash when     loading dynamic-link libraries. An attacker can exploit     this, via a specially crafted .dll file, to execute     arbitrary code. (CVE-2016-4116)

The version of Google Chrome installed on the remote Windows host is prior to 50.0.2661.102. It is, therefore, affected by multiple vulnerabilities :

  - A same-origin bypass vulnerability exists in DOM due to     scripts being permitted run while a node is being     adopted. A context-dependent attacker can exploit this     to bypass the same-origin policy. (CVE-2016-1667)

  - A same-origin bypass vulnerability exists due to a flaw     in the Blink V8 bindings. A context-dependent attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1668)

  - An overflow condition exists in V8 due to improper     validation of user-supplied input. A context-dependent     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1669)

  - A race condition exists in the loader related to the use     of ids. An attacker can exploit this to have an     unspecified impact. (CVE-2016-1670)

  - Multiple type confusion errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1105, CVE-2016-4117)

  - Multiple use-after-free errors exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1097, CVE-2016-1106,     CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,     CVE-2016-1110, CVE-2016-4108, CVE-2016-4110,     CVE-2016-4121)

  - A heap buffer overflow condition exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists in the bundled     version of Adobe Flash that allows an attacker to     execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist in the bundled     version of Adobe Flash that allow an attacker to execute     arbitrary code. (CVE-2016-1096, CVE-2016-1098,     CVE-2016-1099, CVE-2016-1100, CVE-2016-1102,     CVE-2016-1104, CVE-2016-4109, CVE-2016-4111,     CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,     CVE-2016-4115, CVE-2016-4120, CVE-2016-4160,     CVE-2016-4161, CVE-2016-4162, CVE-2016-4163)

  - A flaw exists in the bundled version of Adobe Flash when     loading dynamic-link libraries. An attacker can exploit     this, via a specially crafted .dll file, to execute     arbitrary code. (CVE-2016-4116)

The remote Windows host is missing KB3163207. It is, therefore, affected by multiple vulnerabilities :

  - Multiple type confusion errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1105,     CVE-2016-4117)

  - Multiple use-after-free errors exist that allow an     attacker to execute arbitrary code. (CVE-2016-1097,     CVE-2016-1106, CVE-2016-1107, CVE-2016-1108,     CVE-2016-1109, CVE-2016-1110, CVE-2016-4108,     CVE-2016-4110, CVE-2016-4121)

  - A heap buffer overflow condition exists that allows an     attacker to execute arbitrary code. (CVE-2016-1101)

  - An unspecified buffer overflow exists that allows an     attacker to execute arbitrary code. (CVE-2016-1103)

  - Multiple memory corruption issues exist that allow an     attacker to execute arbitrary code. (CVE-2016-1096,     CVE-2016-1098, CVE-2016-1099, CVE-2016-1100,     CVE-2016-1102, CVE-2016-1104, CVE-2016-4109,     CVE-2016-4111, CVE-2016-4112, CVE-2016-4113,     CVE-2016-4114, CVE-2016-4115, CVE-2016-4120,     CVE-2016-4160, CVE-2016-4161, CVE-2016-4162,     CVE-2016-4163)

  - A flaw exists when loading dynamic-link libraries. An     attacker can exploit this, via a specially crafted .dll     file, to execute arbitrary code. (CVE-2016-4116)

Note: KB3163207 replaces KB3157993 which did not address CVE-2016-4117.

ID	Name	Product	Family	Severity
91702	GLSA-201606-08 : Adobe Flash Player: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
91697	FreeBSD : flash -- multiple vulnerabilities (0c6b008d-35c4-11e6-8e82-002590263bf5)	Nessus	FreeBSD Local Security Checks	critical
9354	Flash Player < 11.2.202.621 / 18.0.0.352 / 21.0.0.242 Multiple Vulnerabilities (APSB16-15)	Nessus Network Monitor	Web Clients	critical
91217	SUSE SLED12 Security Update : flash-player (SUSE-SU-2016:1305-1)	Nessus	SuSE Local Security Checks	critical
91204	openSUSE Security Update : flash-player (openSUSE-2016-587)	Nessus	SuSE Local Security Checks	critical
91178	openSUSE Security Update : flash-player (openSUSE-2016-585)	Nessus	SuSE Local Security Checks	critical
91165	Adobe Flash Player for Mac <= 21.0.0.226 Multiple Vulnerabilities (APSB16-15)	Nessus	MacOS X Local Security Checks	critical
91164	Adobe AIR for Mac <= 21.0.0.198 Multiple Vulnerabilities (APSB16-15)	Nessus	MacOS X Local Security Checks	critical
91163	Adobe Flash Player <= 21.0.0.226 Multiple Vulnerabilities (APSB16-15)	Nessus	Windows	critical
91162	Adobe AIR <= 21.0.0.198 Multiple Vulnerabilities (APSB16-15)	Nessus	Windows	critical
91156	RHEL 5 / 6 : flash-plugin (RHSA-2016:1079)	Nessus	Red Hat Local Security Checks	critical
91129	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
91128	Google Chrome < 50.0.2661.102 Multiple Vulnerabilities	Nessus	Windows	critical
91013	MS16-064: Security Update for Adobe Flash Player (3163207)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2016-4117

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical