CVE-2016-7879

moderate-risk

Published 2016-12-15

Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the NetConnection class when handling an attached script object. Successful exploitation could lead to arbitrary code execution.

Do I need to act?

3.8% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (5)

Flash Player Desktop Runtime

Flash Player

Affected Vendors

Adobe

References (18)

Broken Link http://lists.opensuse.org/opensuse-security-announce/2016-12/msg00064.html

Broken Link http://lists.opensuse.org/opensuse-updates/2016-12/msg00112.html

Third Party Advisory http://rhn.redhat.com/errata/RHSA-2016-2947.html

Third Party Advisory http://www.securityfocus.com/bid/94873

Broken Link http://www.securitytracker.com/id/1037442

Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-16-619

Patch https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-15...

Patch https://helpx.adobe.com/security/products/flash-player/apsb16-39.html

Third Party Advisory https://security.gentoo.org/glsa/201701-17