CVE-2016-1000: Use After Free
First published: Sat Mar 12 2016(Updated: )
Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-0999.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Acrobat Reader | <=20.0.0.306 | |
| Apple iOS and macOS | ||
| Chrome OS | ||
| Linux Kernel | ||
| Microsoft Windows | ||
| Adobe AIR SDK | <=20.0.0.233 | |
| Android | ||
| Adobe AIR | <=20.0.0.260 | |
| Samsung X14J eu | =t-ms14jakucb-1102.5 | |
| iStyle @cosme iPhone OS | ||
| Adobe Acrobat Reader | <=11.2.202.569 | |
| Adobe Flash Player | <=20.2.2.306 | |
| Adobe Acrobat Reader | <=20.0.0.306 | |
| Microsoft Windows 10 | ||
| Adobe Acrobat Reader | <=20.0.0.306 | |
| Microsoft Windows 8.1 | ||
| Adobe AIR | <=20.0.0.260 | |
| Adobe AIR SDK & Compiler | <=20.0.0.260 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html
- http://rhn.redhat.com/errata/RHSA-2016-1582.html
- http://rhn.redhat.com/errata/RHSA-2016-1583.html
- http://www.securityfocus.com/bid/84312
- http://www.securitytracker.com/id/1035251
- https://helpx.adobe.com/security/products/flash-player/apsb16-08.html
- https://security.gentoo.org/glsa/201603-07
- https://www.exploit-db.com/exploits/39610/
Frequently Asked Questions
What is the severity of CVE-2016-1000?
CVE-2016-1000 is rated as a critical vulnerability allowing attackers to execute arbitrary code.
How do I fix CVE-2016-1000?
To fix CVE-2016-1000, update Adobe Flash Player to version 18.0.0.333 or later for Windows and OS X, and to version 11.2.202.577 or later for Linux.
Which versions of Adobe software are affected by CVE-2016-1000?
CVE-2016-1000 affects Adobe Flash Player versions before 18.0.0.333, Adobe AIR versions before 21.0.0.176, and their respective SDKs.
Can CVE-2016-1000 be exploited remotely?
Yes, attackers can exploit CVE-2016-1000 remotely, potentially leading to complete system compromise.
What platforms are impacted by CVE-2016-1000?
The impacted platforms include Adobe Flash Player on Windows, macOS, and Linux, as well as Adobe AIR across these same systems.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/references
- agent/severity
- agent/remedy
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe acrobat reader
- version/adobe acrobat reader/20.0.0.306
- vendor/apple
- canonical/apple ios and macos
- vendor/google
- canonical/chrome os
- vendor/linux
- canonical/linux kernel
- vendor/microsoft
- canonical/microsoft windows
- canonical/adobe air sdk
- version/adobe air sdk/20.0.0.233
- canonical/android
- canonical/adobe air
- version/adobe air/20.0.0.260
- vendor/samsung
- canonical/samsung x14j eu
- version/samsung x14j eu/t-ms14jakucb-1102.5
- canonical/istyle @cosme iphone os
- version/adobe acrobat reader/11.2.202.569
- canonical/adobe flash player
- version/adobe flash player/20.2.2.306
- canonical/microsoft windows 10
- canonical/microsoft windows 8.1
- canonical/adobe air sdk & compiler
- version/adobe air sdk & compiler/20.0.0.260