CVE-2016-1019KEV · OVERDUE

Adobe Flash Player Arbitrary Code Execution Vulnerability

Critical · published April 7, 2016

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 97.7th percentile for exploit probability.

1673
days past CISA
deadline
CVSS v3.1
9.8
EPSS
22%
Percentile
97.7
In the wild
Confirmed
What it is

🚨 Adobe Flash Player is still making headlines for all the wrong reasons! An outdated version could lead to a devastating crash or even let attackers execute arbitrary code. 🔥 Think of Adobe Flash Player as a theme park where rides are constantly breaking down. If a ride malfunctioned due to poor maintenance, not only could it crash, but an unscrupulous prankster might take over the controls and cause chaos! With this vulnerability, an attacker could cause the application to crash, leading to downtime and potentially disrupting critical functions. Even worse, they could gain access to execute arbitrary code, opening the door for further exploits and data breaches. The consequences could be absolutely devastating!

Put simply

Think of Adobe Flash Player as a theme park where rides are constantly breaking down. If a ride malfunctioned due to poor maintenance, not only could it crash, but an unscrupulous prankster might take over the controls and cause chaos! This vulnerability allows remote attackers to exploit unspecified vectors, leading to a denial of service or arbitrary code execution in Adobe Flash Player 21.0.0.197 and earlier versions. This means that if your Flash Player is outdated, you might be an easy target for malicious attacks.

What to do

With this vulnerability, an attacker could cause the application to crash, leading to downtime and potentially disrupting critical functions. Even worse, they could gain access to execute arbitrary code, opening the door for further exploits and data breaches. The consequences could be absolutely devastating! Immediately update Adobe Flash Player to the latest version to address this vulnerability. Ensure that you have implemented a robust security protocol that includes regular updates and monitoring for potential threats. Don't let your defenses down! You can tackle this! Update your Flash Player and secure your systems. Security hero status: activated! 🦸

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.22316 · 97.7th percentile
Published
2016-04-07T14:59Z
KEV added
2022-03-03 · due 2022-03-24
Affected products (9)
ProductVersionsFixed in
adobe/flash_player_desktop_runtime≤ 21.0.0.197—
adobe/flash_player≤ 18.0.0.333—
adobe/flash_player≤ 21.0.0.197—
adobe/flash_player≤ 21.0.0.197—
adobe/flash_player≤ 21.0.0.197—
adobe/flash_player≤ 11.2.202.577—
adobe/air_desktop_runtime≤ 21.0.0.176—
adobe/air_sdk≤ 21.0.0.176—
adobe/air_sdk_\&_compiler≤ 21.0.0.176—
References (32)
http://blogs.adobe.com/psirt/?p=1330 · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html · [email protected]http://rhn.redhat.com/errata/RHSA-2016-0610.html · [email protected]http://www.securityfocus.com/bid/85856 · [email protected]http://www.securitytracker.com/id/1035491 · [email protected]https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050 · [email protected]https://helpx.adobe.com/security/products/flash-player/apsa16-01.html · [email protected]https://helpx.adobe.com/security/products/flash-player/apsb16-10.html · [email protected]https://security.gentoo.org/glsa/201606-08 · [email protected]https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html · [email protected]http://blogs.adobe.com/psirt/?p=1330 · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html · af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html · af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2016-0610.html · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/85856 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1035491 · af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050 · af854a3a-2127-422b-91ae-364da2661108https://helpx.adobe.com/security/products/flash-player/apsa16-01.html · af854a3a-2127-422b-91ae-364da2661108https://helpx.adobe.com/security/products/flash-player/apsb16-10.html · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201606-08 · af854a3a-2127-422b-91ae-364da2661108https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html · af854a3a-2127-422b-91ae-364da2661108https://github.com/cisagov/vulnrichment/issues/196 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1019 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 MAR 00:00Z
    Added to CISA KEV — remediate by Mar 24
    kev
  • 07 APR 10:00Z
    Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via…
    cvelistv5