CVE-2016-1014 Path traversal in n/a
Local attackers can gain privileges by placing a malicious file in a directory searched by Adobe Flash Player due to an untrusted search path vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-1014?
CVE-2016-1014 is a high-severity path traversal vulnerability in Adobe Air Desktop Runtime, published on 9 Apr 2016. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows local users to gain privileges via a Trojan horse resource in an unspecified directory.
Weakness: CWE-426
Which versions are affected by CVE-2016-1014?
It affects 5 products.
Products include Adobe Air Desktop Runtime, Adobe Air Sdk, Adobe Air Sdk \& Compiler, Adobe Flash Player, Adobe Flash Player Desktop Runtime.
How do I fix CVE-2016-1014?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2016-1014 being exploited?
There is no known exploitation of CVE-2016-1014 in the wild and no public exploit code.
Other vulnerabilities in Adobe Air Desktop Runtime
Sources
Also known as GHSA-fjcq-4c82-3m9g, UBUNTU-CVE-2016-1014.