CVE-2016-4152
high
CVSS v3
8.8
CVSS v2
9.3
VIR risk
8.8
Description
Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.
Predictions
Exploit likelihood
92%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: psirt@adobe.com — https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
Vendor advisory: psirt@adobe.com — https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-083
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2016-4152.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| sles | affected | | |
| rhel | 5.0 | affected | |
| rhel | 6.0 | affected | |
| macos | - | not-affected | |
| linux-kernel | - | not-affected | |
| windows | - | not-affected | |
| suse | 13.1 | affected | |
| suse | 13.2 | affected | |
| suse | 12 | affected | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| adobe | flash_player_desktop_runtime | {"endIncluding":"21.0.0.242"} | |
| adobe | flash_player | {"endIncluding":"11.2.202.621"} | |
References
- https://www.suse.com/security/cve/CVE-2016-4152.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00038.html
- http://www.securitytracker.com/id/1036117
- https://access.redhat.com/errata/RHSA-2016:1238
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-083
- https://helpx.adobe.com/security/products/flash-player/apsb16-18.html
CWEs
CWE-787
Verify integrity in audit chain (admin only). AS-IS.