Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Flash Player < 11.2.202.644 / 23.0.0.207 Multiple Vulnerabilities (APSB16-37)

Critical

Synopsis

The remote host is running an outdated version of Adobe Flash Player that is affected by multiple attack vectors.

Description

Versions of Adobe Flash Player prior to 11.2.202.644 and 23.0.0.207 are unpatched, and therefore affected by the following vulnerabilities :

- A use-after-free error exists when using ActionScript to manipulate the 'AVSegmentedSource' class allowing a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-7857) - A use-after-free error exists that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. The issue exists in the 'addCallback' method of the 'ExternalInterface'. (CVE-2016-7858) - A use-after-free error exists that is triggered when handling the 'AS2 extends' operator. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-7859) - A use-after-free error exists that is triggered when handling AdvertisingMetadata, Metadata, MovieClip, and TextField objects. These may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-7860, CVE-2016-7861, CVE-2016-7862, CVE-2016-7863) - A use-after-free error exists when handling the Selection 'setFovus' method that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-7864, CVE-2016-7865)

Solution

Upgrade to Adobe Flash Player version 23.0.0.207 or later. If 23.x cannot be obtained, version 11.2.202.644 has also been patched for these vulnerabilities.