vulnwire
7.8high

CVE-2016-4171KEVin critical feed

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vector…

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · CNA
CISA KEV
Yes
added 2022-03-25
EPSS
20.1%
percentile 97%
Public exploits
0
none known

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-04-15 (4 y ago)
Ransomware use
Unknown
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Vendor / product
Adobe / Flash Player
CISA name
Adobe Flash Player Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
total
Assessed
11 mo ago

Exploit prediction (EPSS)

20.05% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

References

  • security.gentoo.org /glsa/201606-08 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • helpx.adobe.com /security/products/flash-player/apsa16-03.html · x_refsource_CONFIRM, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-06/msg00038.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • kb.cert.org /vuls/id/748992 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • access.redhat.com /errata/RHSA-2016:1238 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-06/msg00035.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • securitytracker.com /id/1036094 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • lists.opensuse.org /opensuse-security-announce/2016-06/msg00031.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • securityfocus.com /bid/91184 · vdb-entry, x_refsource_BID, x_transferred
  • helpx.adobe.com /security/products/flash-player/apsb16-18.html · x_refsource_CONFIRM, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-4171 · government-resource
  • github.com /cisagov/vulnrichment/issues/196 · issue-tracking

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.