Lucene search

[email protected]CVE-2016-1001

HistoryMar 12, 2016 - 3:59 p.m.

CVE-2016-1001

2016-03-1215:59:21

CWE-787

[email protected]

web.nvd.nist.gov

adobe flash player

cve-2016-1001

buffer overflow

security vulnerability

nvd

adobe air

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.907 High

EPSS

Percentile

98.9%

JSON

Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors.

Affected configurations

NVD

Node

adobeflash_playerRange≤20.0.0.306chrome

AND

applemac_os_xMatch-

googlechrome_osMatch-

linuxlinux_kernelMatch-

microsoftwindowsMatch-

Node

adobeairRange≤20.0.0.233

AND

googleandroidMatch-

Node

adobeair_sdkRange≤20.0.0.260

samsungx14j_firmwareMatcht-ms14jakucb-1102.5

AND

appleiphone_osMatch-

applemac_os_xMatch-

googleandroidMatch-

microsoftwindowsMatch-

Node

adobeflash_playerRange≤11.2.202.569

AND

linuxlinux_kernelMatch-

Node

adobeflash_player_desktop_runtimeRange≤20.2.2.306

AND

applemac_os_xMatch-

microsoftwindowsMatch-

Node

adobeflash_playerRange≤20.0.0.306edge

AND

microsoftwindows_10Match-

Node

adobeflash_playerRange≤20.0.0.306internet_explorer

AND

microsoftwindows_10Match-

microsoftwindows_8.1Match-

Node

adobeair_desktop_runtimeRange≤20.0.0.260

AND

applemac_os_xMatch-

microsoftwindowsMatch-

Node

adobeair_sdk_\&_compilerRange≤20.0.0.260

AND

appleiphone_osMatch-

applemac_os_xMatch-

googleandroidMatch-

microsoftwindowsMatch-

CPENameOperatorVersion
adobe:flash_playeradobe flash playerle20.0.0.306

CPE	Name	Operator	Version
adobe:flash_player	adobe flash player	le	20.0.0.306

References

lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html

lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.html

lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html

lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html

www.securitytracker.com/id/1035251

helpx.adobe.com/security/products/flash-player/apsb16-08.html

security.gentoo.org/glsa/201603-07

www.exploit-db.com/exploits/39609/

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9 High

AI Score

Confidence

High

0.907 High

EPSS

Percentile

98.9%

JSON

Related for CVE-2016-1001

zdt1 prion1 ubuntucve1 cvelist1 checkpoint_advisories1 nvd1 openvas12 mageia1 kaspersky2 nessus14 altlinux2 freebsd1 archlinux2 suse4 redhat1 gentoo1