CVE-2016-4117 Adobe Flash Player memory corruption (RHSA-2016:1079 / EDB-46339)

A vulnerability classified as critical has been found in Adobe Flash Player up to 21.0.0.226 (Multimedia Player Software). Affected is an unknown part. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

The bug was discovered 10/05/2016. The weakness was shared 11/05/2016 with FireEye (Website). The advisory is available at helpx.adobe.com. This vulnerability is traded as CVE-2016-4117 since 04/27/2016. It is possible to launch the attack remotely. The exploitation doesn’t require any form of authentication. Technical details are unknown but a private exploit is available.

It is declared as highly functional. The vulnerability scanner Nessus provides a plugin with the ID 91163 (Adobe Flash Player Windows and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 168849 (OpenSuSE Security Update for flash-player (openSUSE-SU- 2016:1308-1)).

The impacted product is end-of-life and should be disconnected if still in use.

Upgrading eliminates this vulnerability. A possible mitigation has been published 1 days after the disclosure of the vulnerability.

The vulnerability is also documented in the databases at Zero-Day.cz (198), Tenable (91163) and SecurityFocus (BID 90505†).

Type

Vendor

Yam

Version

License

Support

Video

VulDB CVSS-B Score: 🔍
VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍VulDB Meta Base Score: 8.5
VulDB Meta Temp Score: 8.4

VulDB Base Score: 7.3
VulDB Temp Score: 7.0
VulDB Vector: 🔍
VulDB Reliability: 🔍

NVD Base Score: 9.8
NVD Vector: 🔍

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

exploitinginfo

class: Memory corruption
CWE: CWE-119
CAPEC: 🔍
ATT&CK: 🔍

Local: No
remote: Forks

Availability: 🔍
Access: Private
Status: Highly functional
Download: 🔍

EPSS Score: 🔍
EPSS Percentile: 🔍

KEV Added: 🔍
KEV Due: 🔍
KEV Remediation: 🔍
KEV Ransomware: 🔍
KEV Notice: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

Nessus ID: 91163
Nessus Name: Adobe Flash Player Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍

OpenVAS ID: 867042
OpenVAS Name: Adobe Flash Player Security Updates( apsa16-02 )-Windows
OpenVAS File: 🔍
OpenVAS Family: 🔍

Qualys ID: 🔍
Qualys Name: 🔍

Exploit-DB: 🔍
Zero-Day.cz: 🔍

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Activate APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍

04/27/2016 🔍
05/10/2016 +13 days 🔍
05/10/2016 +0 days 🔍
05/10/2016 +0 days 🔍
11/05/2016 +1 days 🔍
11/05/2016 +0 days 🔍
12/05/2016 +1 days 🔍
05/16/2016 +4 days 🔍
06/10/2024 +3065 days 🔍Vendor: adobe.com

Advisory: RHSA-2016:1079
Organization: FireEye
Status: Not defined
confirmation: 🔍

CVE: CVE-2016-4117 (🔍)
OVAL: 🔍

SecurityFocus: 90505 – Adobe Flash Player CVE-2016-4117 Unspecified Remote Code Execution Vulnerability
SecurityTracker: 1035826

scip labs: https://www.scip.ch/en/?labs.20161013

Created: 05/11/2016 15:08
Updated: 06/10/2024 03:30
Changes: 11/05/2016 15:08 (77), 07/29/2019 18:33 (8), 08/18/2022 11:20 (5), 04/23/2024 11:49 (23), 07 /07/2024 21:05 (2), 07/17/2024 00:12 (1), 09/09/2024 22:29 (1), 06/10/2024 03:30 (2)
Complete: 🔍
Cache ID: 88:21D:117