CVE-2016-1001
published 2016-03-12CVE-2016-1001: Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on…
PriorityP270high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
26.23%
97.8th percentile
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | air | <= 20.0.0.233 | — |
| adobe | air_desktop_runtime | <= 20.0.0.260 | — |
| adobe | air_sdk | <= 20.0.0.260 | — |
| adobe | air_sdk_compiler | <= 20.0.0.260 | — |
| adobe | flash_player | <= 20.0.0.306 | — |
| adobe | flash_player | <= 11.2.202.569 | — |
| adobe | flash_player_desktop_runtime | <= 20.2.2.306 | — |
| samsung | x14j_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2016-1001 was incorporated into the Angler Exploit Kit; monitor for Angler EK traffic patterns targeting Adobe Flash. ↗
- →The vulnerability is triggered via a heap overflow in the Zlib codec when processing malicious FLV files in Adobe Flash; inspect FLV file delivery for exploitation attempts. ↗
- →The PoC uses a specifically crafted file named 'smalloverflow.flv'; presence of this filename in web server logs or network traffic may indicate exploitation attempts. ↗
- ·The vulnerability affects Adobe Flash Player before 18.0.0.333 and 19.x–21.x before 21.0.0.182 on Windows/OS X, and before 11.2.202.577 on Linux; also Adobe AIR and AIR SDK/Compiler before 21.0.0.176. Detection should account for all affected platforms and version ranges. ↗
- ·The root cause vectors are officially described as 'unspecified,' limiting the ability to craft precise signature-based detections from vendor advisories alone. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xjg9-7m45-xm66: Heap-based buffer overflow in Adobe Flash Player before 18
ghsa_unreviewed·2022-05-17
CVE-2016-1001 [CRITICAL] CWE-119 GHSA-xjg9-7m45-xm66: Heap-based buffer overflow in Adobe Flash Player before 18
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors.
OSV
CVE-2016-1001: Heap-based buffer overflow in Adobe Flash Player before 18
osv·2016-03-12·CVSS 8.8
CVE-2016-1001 [HIGH] CVE-2016-1001: Heap-based buffer overflow in Adobe Flash Player before 18
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors.
Red Hat
flash-plugin: multiple code execution issues fixed in APSB16-08
vendor_redhat·2016-03-10·CVSS 8.8
CVE-2016-1001 [HIGH] flash-plugin: multiple code execution issues fixed in APSB16-08
flash-plugin: multiple code execution issues fixed in APSB16-08
Heap-based buffer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors.
No detection rules found.
Exploit-DB
Adobe Flash - Zlib Codec Heap Overflow
exploitdb·2016-03-23
CVE-2016-1001 Adobe Flash - Zlib Codec Heap Overflow
Adobe Flash - Zlib Codec Heap Overflow
---
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=720
There is a heap overflow in the Zlib codecs used when playing flv files in flash. Sample flv files are attached. Load http://127.0.0.1/LoadMP42.swf?file=smalloverflow.flv to reproduce.
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39609.zip
Exploit-DB
Linux Kernel 4.3.3 (Ubuntu 14.04/15.10) - 'overlayfs' Local Privilege Escalation (1)
exploitdb·2016-01-05·CVSS 6.7
CVE-2015-8660 [MEDIUM] Linux Kernel 4.3.3 (Ubuntu 14.04/15.10) - 'overlayfs' Local Privilege Escalation (1)
Linux Kernel 4.3.3 (Ubuntu 14.04/15.10) - 'overlayfs' Local Privilege Escalation (1)
---
/*
just another overlayfs exploit, works on kernels before 2015-12-26
# Exploit Title: overlayfs local root
# Date: 2016-01-05
# Exploit Author: rebel
# Version: Ubuntu 14.04 LTS, 15.10 and more
# Tested on: Ubuntu 14.04 LTS, 15.10
# CVE : CVE-2015-8660
blah@ubuntu:~$ id
uid=1001(blah) gid=1001(blah) groups=1001(blah)
blah@ubuntu:~$ uname -a && cat /etc/issue
Linux ubuntu 3.19.0-42-generic #48~14.04.1-Ubuntu SMP Fri Dec 18 10:24:49 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Ubuntu 14.04.3 LTS \n \l
blah@ubuntu:~$ ./overlayfail
root@ubuntu:~# id
uid=0(root) gid=1001(blah) groups=0(root),1001(blah)
12/2015
by rebel
6354b4e23db225b565d79f226f2e49ec0fe1e19b
*/
#include
#include
#include
#include
#inclu
Recorded Future
Is PR Hype Adding to Vulnerability Vagueness?
blogs_recorded_future
Is PR Hype Adding to Vulnerability Vagueness?
## Is PR Hype Adding to Vulnerability Vagueness?
## Key Takeaways
Learn why the best marketing doesn’t equal the most severe vulnerabilities.
Find better ways than news media and manual feeds to research new vulnerabilities.
Understand how threat intelligence helps inform security operations when responding to vulnerabilities.
We’re becoming used to it. Another scary vulnerability, another catchy name, another flashy logo, and a slick website to go with it. At the beginning of March a team of researchers announced that they had discovered “DROWN,” a vulnerability in HTTPS and other services that rely on SSL and TLS.
The website they created is comprehensive ; it outlines the nature of the vulnerability in deep technical detail and presents the best way for organizations to identify w
Zscaler
Zscaler found Multiple Security Vulnerabilities | 03-11-2016
blogs_zscaler
Zscaler found Multiple Security Vulnerabilities | 03-11-2016
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
Recorded Future
Is PR Hype Adding to Vulnerability Vagueness?
blogs_recorded_future
Is PR Hype Adding to Vulnerability Vagueness?
# Is PR Hype Adding to Vulnerability Vagueness?
### Key Takeaways
- Learn why the best marketing doesn’t equal the most severe vulnerabilities.
- Find better ways than news media and manual feeds to research new vulnerabilities.
- Understand how threat intelligence helps inform security operations when responding to vulnerabilities.
We’re becoming used to it. Another scary vulnerability, another catchy name, another flashy logo, and a slick website to go with it. At the beginning of March a team of researchers announced that they had discovered “DROWN,” a vulnerability in HTTPS and other services that rely on SSL and TLS.
The website they created is comprehensive; it outlines the nature of the vulnerability in deep technical detail and presents the best way for organizations to identif
Bugzilla
CVE-2016-10516 python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py
bugzilla·2017-11-10·CVSS 6.1
CVE-2016-10516 [MEDIUM] CVE-2016-10516 python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py
CVE-2016-10516 python-werkzeug: Cross-site scripting in render_full function in debug/tbtools.py
Cross-site scripting (XSS) vulnerability in the render_full function in
debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as
used in Pallets Flask and other products) allows remote attackers to inject
arbitrary web script or HTML via a field that contains an exception
message.
Upstream patch:
https://github.com/pallets/werkzeug/pull/1001
References:
http://blog.neargle.com/2016/09/21/flask-src-review-get-a-xss-from-debuger/
Discussion:
Created python-werkzeug tracking bugs for this issue:
Affects: epel-6 [bug 1512104]
Affects: fedora-all [bug 1512103]
Bugzilla
flash-plugin: multiple code execution issues fixed in APSB16-08
bugzilla·2016-03-11·CVSS 8.8
CVE-2016-0963 [HIGH] flash-plugin: multiple code execution issues fixed in APSB16-08
flash-plugin: multiple code execution issues fixed in APSB16-08
Adobe Security Bulletin APSB16-08 for Adobe Flash Player describes multiple flaws that can possibly lead to code execution when Flash Player is used to play a specially crafted SWF file.
Quoting from the APSB16-08:
These updates resolve integer overflow vulnerabilities that could lead to code execution (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000).
These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2016-1001).
These updates resolve
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.htmlhttp://www.securitytracker.com/id/1035251https://helpx.adobe.com/security/products/flash-player/apsb16-08.htmlhttps://security.gentoo.org/glsa/201603-07https://www.exploit-db.com/exploits/39609/http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.htmlhttp://www.securitytracker.com/id/1035251https://helpx.adobe.com/security/products/flash-player/apsb16-08.htmlhttps://security.gentoo.org/glsa/201603-07https://www.exploit-db.com/exploits/39609/
2016-03-12
Published