vulnwire
8.8high

CVE-2016-7892KEVin critical feed

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextFi…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.1 · CNA
CISA KEV
Yes
added 2022-03-25
EPSS
19.1%
percentile 97%
Public exploits
0
none known

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class. Successful exploitation could lead to arbitrary code execution.

Known exploited (CISA KEV)

Added
4 y ago
Due date
2022-04-15 (4 y ago)
Ransomware use
Unknown
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Vendor / product
Adobe / Flash Player
CISA name
Adobe Flash Player Use-After-Free Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction (EPSS)

19.08% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.18.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD3.18.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA3.18.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.09.3AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • n/a Adobe Flash Player 23.0.0.207 and earlier, 11.2.202.644 and earlier

Classification

Weakness

References

  • lists.opensuse.org /opensuse-security-announce/2016-12/msg00064.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2016/ms16-154 · vendor-advisory, x_refsource_MS, x_transferred
  • security.gentoo.org /glsa/201701-17 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • securitytracker.com /id/1037442 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • rhn.redhat.com /errata/RHSA-2016-2947.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • helpx.adobe.com /security/products/flash-player/apsb16-39.html · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/94877 · vdb-entry, x_refsource_BID, x_transferred
  • lists.opensuse.org /opensuse-updates/2016-12/msg00112.html · vendor-advisory, x_refsource_SUSE, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7892 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.