CVE-2016-7855 Adobe Flash Player Use-After-Free
Remote attackers can execute arbitrary code via a use-after-free vulnerability in Adobe Flash Player, requiring users to upgrade to patched versions.
- Exploited in the wild
- Since 3 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-7855?
CVE-2016-7855 is a high-severity use after free vulnerability in Adobe Flash Player, published on 1 Nov 2016. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in October 2016.
Weakness: CWE-416
Which versions are affected by CVE-2016-7855?
It affects 4 products.
Linux distribution packages (5)
flash-plugin Red Hat:rhel_extras:5::client | All versions | 0:11.2.202.643-1.el5_11 |
flash-plugin Red Hat:rhel_extras:5::server | All versions | 0:11.2.202.643-1.el5_11 |
flash-plugin Red Hat:rhel_extras:6 | All versions | 0:11.2.202.643-1.el6_8 |
flash-player SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 11.2.202.643-146.1 |
flash-player SUSE:Linux Enterprise Workstation Extension 12 SP1 | All versions | 11.2.202.643-146.1 |
Products include Adobe Flash Player, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2016-7855?
Upgrade to a fixed version. US federal agencies must fix it by 24 Mar 2022.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2016-7855 being exploited?
Yes. Attackers have exploited CVE-2016-7855 in the wild since at least 3 Mar 2022.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as GHSA-fq8g-m89m-mrw9, MGASA-2016-0360, RHSA-2016:2119, SUSE-SU-2016:2662-1, UBUNTU-CVE-2016-7855.