CVE-2016-7872 — Use After Free in Adobe Flash Player

CWE-416 — Use After Free5 documents5 sources
Severity
8.8HIGHNVD
EPSS
3.8%
top 11.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Adobe Flash PlayerAdobe Flash Player Desktop Runtime
Timeline
PublishedDec 15
Latest updateMay 14

Description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the MovieClip class related to objects at multiple presentation levels. Successful exploitation could lead to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDadobe/flash_player23.0.0.207+1

Patches

Patch: docs.microsoft.com ↗Patch: helpx.adobe.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-r9gq-799v-8ghf: Adobe Flash Player versions 23↗2022-05-14
▶
CVEList
CVE-2016-7872: Adobe Flash Player versions 23↗2016-12-15
▶

📋Vendor Advisories

1
Red Hat
flash-plugin: multiple code execution issues fixed in APSB16-39↗2016-12-13
▶

💬Community

1
Bugzilla
flash-plugin: multiple code execution issues fixed in APSB16-39↗2016-12-13
▶
CVE-2016-7872 — Use After Free in Adobe Flash Player | cvebase