Description
Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18.0.0.324, Adobe Flash Player for Google Chrome before 20.0.0.267, Adobe Flash Player for Microsoft Edge and Internet Explorer 11 before 20.0.0.267, Adobe Flash Player for Internet Explorer 10 and 11 before 20.0.0.267, Adobe Flash Player for Linux before 11.2.202.559, AIR Desktop Runtime before 20.0.0.233, AIR SDK before 20.0.0.233, AIR SDK & Compiler before 20.0.0.233, AIR for Android before 20.0.0.233.
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-2697.html
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1294580
Vendor Advisory x_refsource_confirm
https://helpx.adobe.com/security/products/flash-player/apsb16-01.html
Scores
CVSS v3
9.8
EPSS
0.0520
EPSS Percentile
91.5%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-416
Status
published
Products (7)
adobe/air
< 20.0.0.204 (2 CPE variants)
adobe/air_sdk
< 20.0.0.204
adobe/air_sdk_\&_compiler
< 20.0.0.204
adobe/flash_player
< 20.0.0.228 (3 CPE variants)
adobe/flash_player
< 20.0.0.235
adobe/flash_player_extended_support_release
< 18.0.0.268
adobe/flash_player_for_linux
< 11.2.202.554
Published
Jun 27, 2017
Tracked Since
Feb 18, 2026