CVE-2016-1005 Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Ado...
HighCVSS 8.8
EPSS 5.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allow attackers to execute arbitrary code or cause a denial of service (uninitialized pointer dereference and memory corruption) via crafted MPEG-4 data, a different vulnerability than CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, and CVE-2016-1002.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe flash player | <= 20.0.0.306 | No fix listed |
| Adobe flash player | <= 11.2.202.569 | No fix listed |
| Adobe air | <= 20.0.0.233 | No fix listed |
| Adobe air sdk | <= 20.0.0.260 | No fix listed |
| samsung x14j firmware | = t-ms14jakucb-1102.5 | No fix listed |
| Adobe flash player desktop runtime | <= 20.2.2.306 | No fix listed |
| Adobe air desktop runtime | <= 20.0.0.260 | No fix listed |
| Adobe air sdk compiler | <= 20.0.0.260 | No fix listed |
References
- SUSE-SU-2016:0715 broken-link mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:0716 broken-link mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:0719 broken-link mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:0734 broken-link mailing-list third-party-advisory vendor-advisory
- 84311 broken-link third-party-advisory vdb-entry
- 1035251 broken-link third-party-advisory vdb-entry
- www.zerodayinitiative.com third-party-advisory vdb-entry
- helpx.adobe.com patch vendor-advisory
- GLSA-201603-07 third-party-advisory vendor-advisory