Detections
Analytics

MS16-036: Security Update for Adobe Flash Player (3144756)

high Nessus Plugin ID 89835

Language:

Synopsis

The remote Windows host has a browser plugin installed that is affected by multiple vulnerabilities.

Description

The remote Windows host is missing KB3144756. It is, therefore, affected by multiple vulnerabilities :

 - Multiple integer overflow conditions exist that allow an attacker to execute arbitrary code. (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010)

 - Multiple use-after-free errors exist that allow an attacker to execute arbitrary code. (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000)

 - A heap overflow condition exists that allows an attacker to execute arbitrary code. (CVE-2016-1001)

 - Multiple memory corruption issues exist that allow an attacker to execute arbitrary code. (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, CVE-2016-1005)

Solution

Microsoft has released a set of patches for Windows 2012, 8.1, RT 8.1, 2012 R2, and 10.

See Also

https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2016/ms16-036

https://helpx.adobe.com/security/products/flash-player/apsb16-08.html

Plugin Details

Severity: High

ID: 89835

File Name: smb_nt_ms16-036.nasl

Version: 1.21

Type: local

Agent: windows

Published: 3/11/2016

Updated: 4/25/2023

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 8.1

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2016-1010

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:adobe:flash_player

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/10/2016

Vulnerability Publication Date: 3/10/2016

CISA Known Exploited Vulnerability Due Dates: 6/15/2022

Reference Information

CVE: CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987, CVE-2016-0988, CVE-2016-0989, CVE-2016-0990, CVE-2016-0991, CVE-2016-0992, CVE-2016-0993, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000, CVE-2016-1001, CVE-2016-1002, CVE-2016-1005, CVE-2016-1010

BID: 84308, 84310, 84311, 84312

MSFT: MS16-036

MSKB: 3144756