cbcvebase.
CVE-2016-4229
published 2016-07-13

CVE-2016-4229: Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on…

PriorityP271high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
32.46%
98.1th percentile
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

Affected

4 ranges
VendorProductVersion rangeFixed in
adobeflash_player<= 18.0.0.360—
adobeflash_player<= 22.0.0.192—
adobeflash_player<= 11.2.202.626—
adobeflash_player_desktop_runtime<= 22.0.0.192—

Detection & IOCsextracted from sources · hover to see the quote

urlhttps://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40310.zip↗
  • →Use-after-free triggered via BitmapData.copyPixels called on a MovieClip context where the MovieClip is freed during parameter conversion (valueOf callback); look for ActionScript calling copyPixels on a MovieClip object with a custom valueOf function on a parameter object that invokes removeMovieClip() ↗
  • →Detect ActionScript patterns where BitmapData.copyPixels is invoked via a MovieClip-bound reference (mc.f = f) combined with a valueOf override on a coordinate parameter object that calls removeMovieClip() — classic UAF heap grooming pattern ↗
  • ·Vulnerability affects Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X, and before 11.2.202.632 on Linux; exploitation is via unspecified vectors beyond the BitmapData.copyPixels PoC ↗
  • ·This is one of nine distinct use-after-free CVEs patched in the same Flash bulletin; detections should not be assumed to cover CVE-2016-4173, -4174, -4222, -4226, -4227, -4228, -4230, -4231, or -4248 ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.