CVSS: 9.3EPSS: 70%CPEs: 31EXPL: 1CVE-2016-1013 – Adobe Flash (Multiple Scripts) - Use-After-Free When Rendering Displays
https://notcve.org/view.php?id=CVE-2016-1013
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1016, CVE-2016-1017, and CVE-2016-1031. Vulnerabilidad de uso después de liberación de memoria en Adobe Flash Player en versiones anteriores a 18.0.0.343 y 19.x hasta la versión 21.x en versiones anteriores a 21.0.0.213 en Windows y OS X y en versiones anteriores a 11.2.202.616 en Linux permite a atacantes ejecutar código arbitrario a través de vectores no especificados, una vulnerabilidad diferente de CVE-2016-1011, CVE-2016-1016, CVE-2016-1017 y CVE-2016-1031. • https://www.exploit-db.com/exploits/39778 http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html http://rhn.redhat.com/errata/RHSA-2016-0610.html http://www.securityfocus.com/bid/85926 http://www.securitytracker.com/id/1035509 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050 https://helpx.adobe.com/security/products/flash-player/apsb16-10.html https://access • CWE-416: Use After Free •
CVSS: 7.3EPSS: 0%CPEs: 31EXPL: 0CVE-2016-1014 – flash-plugin: multiple code execution issues fixed in APSB16-10
https://notcve.org/view.php?id=CVE-2016-1014
Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows local users to gain privileges via a Trojan horse resource in an unspecified directory. Vulnerabilidad de búsqueda de ruta no confiable en Adobe Flash Player en versiones anteriores a 18.0.0.343 y 19.x hasta la versión 21.x en versiones anteriores a 21.0.0.213 en Windows y OS X y en versiones anteriores a 11.2.202.616 en Linux permite a usuarios locales ganar privilegios a través de un recurso Troyano en un directorio no especificado. Adobe Flash Player versions prior to 22.0.0.192 and 18.0.0.360 suffer from a DLL hijacking vulnerability. • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html http://packetstormsecurity.com/files/137532/Adobe-Flash-Player-DLL-Hijacking.html http://rhn.redhat.com/errata/RHSA-2016-0610.html http://seclists.org/fulldisclosure/2016/Jun/39 http://www.securityfocus.com/archive/1/538699/100/0/threaded http://www.securitytracker.com/id/1035509 https://docs.microsoft.com/en-us/security-updates/securitybulletins • CWE-426: Untrusted Search Path •
CVSS: 9.3EPSS: 3%CPEs: 31EXPL: 0CVE-2016-1017 – Adobe Flash AS2 LoadVars decode Use-After-Free Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-1017
Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, and CVE-2016-1031. Vulnerabilidad de uso después de liberación de memoria en la función LoadVars.decode en Adobe Flash Player en versiones anteriores a 18.0.0.343 y 19.x hasta la versión 21.x en versiones anteriores a 21.0.0.213 en Windows y OS X y en versiones anteriores a 11.2.202.616 en Linux permite a atacantes ejecutar código arbitrario a través de vectores no especificados, una vulnerabilidad diferente de CVE-2016-1011, CVE-2016-1013, CVE-2016-1016 y CVE-2016-1031. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of LoadVars.decode. The issue lies in the failure to safely hold a reference to arguments during execution of the function. • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html http://rhn.redhat.com/errata/RHSA-2016-0610.html http://www.securityfocus.com/bid/85926 http://www.securitytracker.com/id/1035509 http://www.zerodayinitiative.com/advisories/ZDI-16-225 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050 https://helpx.adobe.com/security/products/flash-player/apsb16-10.html https: • CWE-416: Use After Free •
CVSS: 9.3EPSS: 2%CPEs: 31EXPL: 0CVE-2016-1018 – Adobe Flash JPEG-XR Parsing Stack Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-1018
Stack-based buffer overflow in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via crafted JPEG-XR data. Desbordamiento de buffer basado en pila en Adobe Flash Player en versiones anteriores a 18.0.0.343 y 19.x hasta la versión 21.x en versiones anteriores a 21.0.0.213 en Windows y OS X y en versiones anteriores a 11.2.202.616 en Linux permite a atacantes ejecutar código arbitrario a través de datos JPEG-XR manipulados. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of JPEG-XR files. The issue lies in the failure to properly check that an index is within the bounds of a buffer. • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html http://rhn.redhat.com/errata/RHSA-2016-0610.html http://www.securitytracker.com/id/1035509 http://www.zerodayinitiative.com/advisories/ZDI-16-228 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050 https://helpx.adobe.com/security/products/flash-player/apsb16-10.html https://access.redhat.com/security/cve/CVE-2016& • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 2%CPEs: 31EXPL: 0CVE-2016-1015 – Adobe Flash AS2 NetConnection Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-1015
Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code by overriding NetConnection object properties to leverage an unspecified "type confusion," a different vulnerability than CVE-2016-1019. Adobe Flash Player en versiones anteriores a 18.0.0.343 y 19.x hasta la versión 21.x en versiones anteriores a 21.0.0.213 en Windows y OS X y en versiones anteriores a 11.2.202.616 en Linux permite a atacantes ejecutar código arbitrario sobrescribiendo las propiedades de objeto NetConnection para aprovechar una "confusión de tipo" no especificada, una vulnerabilidad diferente a CVE-2016-1019. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the NetConnection objects. By overriding specific object properties, it is possible to trigger a type confusion condition. • http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html http://rhn.redhat.com/errata/RHSA-2016-0610.html http://www.securityfocus.com/bid/85930 http://www.securitytracker.com/id/1035509 http://www.zerodayinitiative.com/advisories/ZDI-16-227 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050 https://helpx.adobe.com/security/products/flash-player/apsb16-10.html https: • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •