Vulnerabilities > CVE-2016-7855 - Use After Free vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family SuSE Local Security Checks NASL id OPENSUSE-2016-1239.NASL description This update for Adobe Flash Player to 11.2.202.643 fixes the following vulnerability : - CVE-2016-7855: use-after-free vulnerability (APSB16-36, boo#1007098) last seen 2020-06-05 modified 2016-10-31 plugin id 94423 published 2016-10-31 reporter This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/94423 title openSUSE Security Update : flash-player (openSUSE-2016-1239) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2016-2119.NASL description An update for flash-plugin is now available for Red Hat Enterprise Linux 5 Supplementary and Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 11.2.202.643. Security Fix(es) : * This update fixes one vulnerability in Adobe Flash Player. This vulnerability, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content. (CVE-2016-7855) last seen 2020-06-01 modified 2020-06-02 plugin id 94318 published 2016-10-27 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/94318 title RHEL 5 / 6 : flash-plugin (RHSA-2016:2119) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201610-10.NASL description The remote host is affected by the vulnerability described in GLSA-201610-10 (Adobe Flash Player: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, obtain sensitive information, or bypass security restrictions. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 94421 published 2016-10-31 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/94421 title GLSA-201610-10 : Adobe Flash Player: Multiple vulnerabilities NASL family Windows NASL id FLASH_PLAYER_APSB16-36.NASL description The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 23.0.0.185. It is, therefore, affected by an arbitrary code execution vulnerability due to a use-after-free error. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted Flash content, to dereference already freed memory, resulting in the execution of arbitrary code in the context of the current user. last seen 2020-06-01 modified 2020-06-02 plugin id 94334 published 2016-10-27 reporter This script is Copyright (C) 2016-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/94334 title Adobe Flash Player <= 23.0.0.185 Arbitrary Code Execution (APSB16-36) NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS16-128.NASL description The remote Windows host is missing KB3201860. It is, therefore, affected by an arbitrary code execution vulnerability due to a use-after-free error. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted Flash content, to dereference already freed memory, resulting in the execution of arbitrary code in the context of the current user. last seen 2020-06-01 modified 2020-06-02 plugin id 94340 published 2016-10-27 reporter This script is Copyright (C) 2016-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/94340 title MS16-128: Security Update for Adobe Flash Player (3201860) NASL family SuSE Local Security Checks NASL id OPENSUSE-2016-1240.NASL description This update for Adobe Flash Player to 11.2.202.643 fixes the following vulnerability : - CVE-2016-7855: use-after-free vulnerability (APSB16-36, boo#1007098) last seen 2020-06-05 modified 2016-10-31 plugin id 94424 published 2016-10-31 reporter This script is Copyright (C) 2016-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/94424 title openSUSE Security Update : flash-player (openSUSE-2016-1240) NASL family MacOS X Local Security Checks NASL id MACOSX_FLASH_PLAYER_APSB16-36.NASL description The version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 23.0.0.185. It is, therefore, affected by an arbitrary code execution vulnerability due to a use-after-free error. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a website containing specially crafted Flash content, to dereference already freed memory, resulting in the execution of arbitrary code in the context of the current user. last seen 2020-06-01 modified 2020-06-02 plugin id 94335 published 2016-10-27 reporter This script is Copyright (C) 2016-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/94335 title Adobe Flash Player for Mac <= 23.0.0.185 Arbitrary Code Execution (APSB16-36) NASL family SuSE Local Security Checks NASL id SUSE_SU-2016-2662-1.NASL description This update for flash-player to version 11.2.202.643 fixes one security issue. This security issue was fixed : - CVE-2016-7855: Use-after-free vulnerability that could lead to code execution (bsc#1007098). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 94350 published 2016-10-28 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/94350 title SUSE SLED12 Security Update : flash-player (SUSE-SU-2016:2662-1) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_DE6D01D59C4411E6BA670011D823EEBD.NASL description Adobe reports : Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These updates address a critical vulnerability that could potentially allow an attacker to take control of the affected system. Adobe is aware of a report that an exploit for CVE-2016-7855 exists in the wild, and is being used in limited, targeted attacks against users running Windows versions 7, 8.1 and 10. last seen 2020-06-01 modified 2020-06-02 plugin id 94347 published 2016-10-28 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/94347 title FreeBSD : flash -- remote code execution (de6d01d5-9c44-11e6-ba67-0011d823eebd)
Redhat
| advisories |
| ||||
| rpms |
|
The Hacker News
id THN:AE55778CB2A707C015D1983DF59DD593 last seen 2018-01-27 modified 2016-11-02 published 2016-11-01 reporter Swati Khandelwal source https://thehackernews.com/2016/11/windows-zeroday-exploit.html title Microsoft Says Russian Hackers Using Unpatched Windows Bug Disclosed by Google id THN:120C478B9D40684BBDA4E877FEE13E82 last seen 2018-01-27 modified 2016-11-01 published 2016-10-31 reporter Swati Khandelwal source https://thehackernews.com/2016/10/google-windows-zero-day.html title Google discloses Critical Windows Zero-Day that makes all Windows Users Vulnerable
Related news
References
- https://security.googleblog.com/2016/10/disclosing-vulnerabilities-to-protect.html
- https://helpx.adobe.com/security/products/flash-player/apsb16-36.html
- http://www.securityfocus.com/bid/93861
- https://security.gentoo.org/glsa/201610-10
- http://www.securitytracker.com/id/1037111
- http://rhn.redhat.com/errata/RHSA-2016-2119.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-128