Product:
Adobe Flash Player
Summary
A use-after-free vulnerability in Adobe Flash Player allows remote attackers to execute arbitrary code. This vulnerability affects versions before 23.0.0.205 on Windows and OS X, and before 11.2.202.643 on Linux. It was actively exploited in the wild in October 2016.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2016-7855 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious Flash file and host it on a website or send it via email. When a user interacts with the malicious content, the use-after-free condition can be triggered, allowing the attacker to execute arbitrary code on the victim’s system. User interaction is required to initiate the exploit, making it crucial for the attacker to entice the user to engage with the malicious content.
Affected Products
- Adobe Flash Player for Windows: Vulnerable versions prior to 23.0.0.205.
- Adobe Flash Player for OS X: Vulnerable versions prior to 23.0.0.205.
- Adobe Flash Player for Linux: Vulnerable versions prior to 11.2.202.643.
Mitigation
The impacted product is end-of-life and should be disconnected if still in use. Users are strongly advised to remove Adobe Flash Player from their systems to prevent potential exploitation.