Detections
Analytics
Flash Player < 11.2.202.644 / 23.0.0.207 Multiple Vulnerabilities (APSB16-37)
critical Nessus Network Monitor Plugin ID 9802
Synopsis
The remote host is running an outdated version of Adobe Flash Player that is affected by multiple attack vectors.Description
Versions of Adobe Flash Player prior to 11.2.202.644 and 23.0.0.207 are unpatched, and therefore affected by the following vulnerabilities :- A use-after-free error exists when using ActionScript to manipulate the 'AVSegmentedSource' class allowing a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-7857)
- A use-after-free error exists that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. The issue exists in the 'addCallback' method of the 'ExternalInterface'. (CVE-2016-7858)
- A use-after-free error exists that is triggered when handling the 'AS2 extends' operator. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-7859)
- A use-after-free error exists that is triggered when handling AdvertisingMetadata, Metadata, MovieClip, and TextField objects. These may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-7860, CVE-2016-7861, CVE-2016-7862, CVE-2016-7863)
- A use-after-free error exists when handling the Selection 'setFovus' method that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-7864, CVE-2016-7865)
Solution
Upgrade to Adobe Flash Player version 23.0.0.207 or later. If 23.x cannot be obtained, version 11.2.202.644 has also been patched for these vulnerabilities.See Also
https://helpx.adobe.com/security/products/flash-player/apsb16-37.html
Plugin Details
Severity: Critical
ID: 9802
Family: Web Clients
Published: 11/23/2016
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: High
Score: 8.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 8.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 9.4
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:adobe:flash_player
Patch Publication Date: 11/8/2016
Vulnerability Publication Date: 11/8/2016
Reference Information
CVE: CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7860, CVE-2016-7861, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864, CVE-2016-7865