CVE-2016-4117 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CriticalCVSS 9.8
EPSS 94.3%
CISA KEV
added 2022-03-03 · due 2022-03-24
Ransomware
Exploited in the wild
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
CISA Known Exploited Vulnerability
- Date added
- 2022-03-03
- Due date (FCEB)
- 2022-03-24
- Ransomware use
- Known
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe flash player | <= 21.0.0.226 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server from rhui | = 5.0 | No fix listed |
| redhat enterprise linux server from rhui | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| openSUSE evergreen | = 11.4 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| opensuse | = 13.2 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise desktop | = 12-sp1 | No fix listed |
| SUSE linux enterprise workstation extension | = 12 | No fix listed |
| SUSE linux enterprise workstation extension | = 12-sp1 | No fix listed |
References
- GLSA-201606-08 third-party-advisory vendor-advisory
- openSUSE-SU-2016:1309 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2016:1305 mailing-list third-party-advisory vendor-advisory
- 1035826 broken-link third-party-advisory vdb-entry
- 46339 exploit third-party-advisory vdb-entry
- openSUSE-SU-2016:1306 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2016:1308 mailing-list third-party-advisory vendor-advisory
- helpx.adobe.com broken-link
- 90505 broken-link third-party-advisory vdb-entry
- helpx.adobe.com broken-link vendor-advisory
- RHSA-2016:1079 third-party-advisory vendor-advisory
- www.cisa.gov government-resource us-government-resource
- github.com issue-tracking