[email protected]CVE-2016-1017

HistoryApr 09, 2016 - 1:59 a.m.

CVE-2016-1017

2016-04-0901:59:00

CWE-416

[email protected]

web.nvd.nist.gov

cve-2016-1017

vulnerability

adobe flash player

use-after-free

arbitrary code

security

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.03 Low

EPSS

Percentile

90.9%

JSON

Use-after-free vulnerability in the LoadVars.decode function in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, and CVE-2016-1031.

CPENameOperatorVersion
adobe:flash_playeradobe flash playerle11.2.202.577
adobe:flash_player_desktop_runtimeadobe flash player desktop runtimele21.0.0.197
adobe:flash_playeradobe flash playerle18.0.0.333
adobe:flash_playeradobe flash playerle21.0.0.197
adobe:air_desktop_runtimeadobe air desktop runtimele21.0.0.176
adobe:air_sdkadobe air sdkle21.0.0.176
adobe:air_sdk_\&_compileradobe air sdk \& compilerle21.0.0.176

CPE	Name	Operator	Version
adobe:flash_player	adobe flash player	le	11.2.202.577
adobe:flash_player_desktop_runtime	adobe flash player desktop runtime	le	21.0.0.197
adobe:flash_player	adobe flash player	le	18.0.0.333
adobe:flash_player	adobe flash player	le	21.0.0.197
adobe:air_desktop_runtime	adobe air desktop runtime	le	21.0.0.176
adobe:air_sdk	adobe air sdk	le	21.0.0.176
adobe:air_sdk_\&_compiler	adobe air sdk \& compiler	le	21.0.0.176