CVE-2016-7874 — Out-of-bounds Write in Adobe Flash Player

CWE-787 — Out-of-bounds WriteCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents6 sources
Severity
8.8HIGHNVD
EPSS
5.1%
top 10.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Adobe Flash PlayerAdobe Flash Player Desktop Runtime
Timeline
PublishedDec 15
Latest updateMay 14

Description

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable memory corruption vulnerability in the NetConnection class when handling the proxy types. Successful exploitation could lead to arbitrary code execution.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDadobe/flash_player23.0.0.207+1

Patches

Patch: docs.microsoft.com ↗Patch: helpx.adobe.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-pc6x-wjvh-h6g8: Adobe Flash Player versions 23↗2022-05-14
▶
CVEList
CVE-2016-7874: Adobe Flash Player versions 23↗2016-12-15
▶

📋Vendor Advisories

1
Red Hat
flash-plugin: multiple code execution issues fixed in APSB16-39↗2016-12-13
▶

🕵️Threat Intelligence

1
Unit42
Palo Alto Networks Unit 42 Vulnerability Research December 2016 Disclosures↗2016-12-16
▶

💬Community

1
Bugzilla
flash-plugin: multiple code execution issues fixed in APSB16-39↗2016-12-13
▶
CVE-2016-7874 — Out-of-bounds Write in Adobe | cvebase