CVE-2016-0984

published 2016-02-10

CVE-2016-0984: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux…

Priority P1 88 high 8.8 CVSS 3.1

AV N AC L PR N UI R S U C H I H A H

KEV ITW EXPLOIT

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0973, CVE-2016-0974, CVE-2016-0975, CVE-2016-0982, and CVE-2016-0983.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
adobe	air_desktop_runtime	<= 20.0.0.233	—
adobe	air_sdk	<= 20.0.0.233	—
adobe	air_sdk_compiler	<= 20.0.0.233	—
adobe	flash_player	<= 11.2.202.559	—
adobe	flash_player	<= 18.0.0.326	—
adobe	flash_player	<= 20.0.0.272	—
adobe	flash_player	<= 20.0.0.286	—
adobe	flash_player_desktop_runtime	<= 20.0.0.286	—

Detection & IOCs extracted from sources · hover to see the quote

hash 4a49135d2ecc07085a8b7c5925a36c0a↗

ip 89.45.67.107↗

url hxxp://89.45.67[.]107/rss/5uzosoff0u.iaf↗

url hxxp://89.45.67[.]107/rss/mo.exe↗

path C:\ProgramData\ManagerApp\AdapterTroubleshooter.exe↗

path C:\ProgramData\ManagerApp\15b937.cab↗

path C:\ProgramData\ManagerApp\install.cab↗

path C:\ProgramData\ManagerApp\msvcr90.dll↗

path C:\ProgramData\ManagerApp\d3d9.dll↗

process winlogon↗

• → CVE-2016-0984 was exploited in the wild by BlackOasis APT as a zero-day in June 2015, delivering FinSpy payloads via exploit chains. Detections for related FinSpy/Flash exploit activity include PDM:Exploit.Win32.Generic, HEUR:Exploit.SWF.Generic, and HEUR:Exploit.MSOffice.Generic. ↗
• → The Flash exploit (related campaign) uses a NOP sled composed of alternating 0x90 and 0x91 opcodes inside SWF files to evade AV detection of large NOP blocks. Consider scanning SWF files for this byte pattern. ↗
• → The CVE-2016-0984 vulnerability is a use-after-free in Adobe Flash Player's Sound.loadPCMFromByteArray. A dangling pointer is created when a second call with a short ByteArray triggers an exception before the pointer is reset; the pointer is then readable via Sound.extract. Monitor for Flash processes crashing or spawning child processes. ↗
• → The exploit chain delivers a Flash exploit embedded as an ActiveX object inside Office documents (.docx). Hunt for Office processes spawning Flash-related child processes or network connections. ↗

• · The IOCs from the Kaspersky/Securelist report (IP 89.45.67.107, mo.exe hash, file paths) are primarily associated with the CVE-2017-11292 campaign by BlackOasis, not directly with CVE-2016-0984 itself. They are included because the source explicitly links BlackOasis to CVE-2016-0984 exploit chains delivering FinSpy, and the infrastructure/TTPs overlap. ↗
• · The exploit-db PoC (39462.zip) is a proof-of-concept for the Sound.loadPCMFromByteArray dangling pointer bug underlying CVE-2016-0984. It demonstrates read-only dangling pointer access, not a full weaponized exploit. ↗

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

osv 8.8 HIGH

vulncheck 8.8 HIGH

cisa 8.8 HIGH

vendor_redhat 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416