KLA10756 Arbitrary code execution in Adobe Flash Player & AIR

Multiple serious vulnerabilities have been found in Adobe Flash Player & AIR. Malicious users can exploit these vulnerabilities to execute arbitrary code.

Below is a complete list of vulnerabilities

1. Type confusion vulnerability can be exploited remotely to execute arbitrary code;
2. Use-after-free vulnerabilities could be exploited remotely to execute arbitrary code;
3. Heap buffer overflow vulnerability can be exploited remotely to execute arbitrary code;
4. Memory corruption vulnerabilities could be exploited remotely to cause denial of service or execute arbitrary code.

Original advisories

Adobe security bulletin

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Adobe-Flash-Player-ActiveX

Adobe-AIR

Adobe-Flash-Player-NPAPI

Adobe-Flash-Player-PPAPI

CVE list

CVE-2016-0985 critical

CVE-2016-0983 critical

CVE-2016-0984 critical

CVE-2016-0981 critical

CVE-2016-0982 critical

CVE-2016-0964 critical

CVE-2016-0965 critical

CVE-2016-0966 critical

CVE-2016-0967 critical

CVE-2016-0968 critical

CVE-2016-0969 critical

CVE-2016-0970 critical

CVE-2016-0972 critical

CVE-2016-0971 critical

CVE-2016-0976 critical

CVE-2016-0975 critical

CVE-2016-0974 critical

CVE-2016-0973 critical

CVE-2016-0980 critical

CVE-2016-0979 critical

CVE-2016-0978 critical

CVE-2016-0977 critical

Solution

Update to the latest versionGet AIR

Get Flash Player

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Adobe Flash Player versions earlier than 20.0.0.306Adobe Flash Player Extended Support Release versions earlier than 18.0.0.329Adobe Flash Player for Linux versions earlier than 11.2.202.569Adobe AIR versions earlier than 20.0.0.260