Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0998, CVE-2016-0999, and CVE-2016-1000.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.54829.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

Configuration 1 [-]

AND
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:a:adobe:air:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND
OR cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*
cpe:2.3:o:samsung:x14j_firmware:t-ms14jakucb-1102.5:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND
cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND
cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*
OR cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND
cpe:2.3:a:adobe:air_desktop_runtime:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND
cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*
OR cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:-:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Package CPE Advisory Released Date
Red Hat Enterprise Linux 5 Supplementary
flash-plugin-0:11.2.202.577-1.el5 cpe:/a:redhat:rhel_extras:5 RHSA-2016:0438 2016-03-11T00:00:00Z
Red Hat Enterprise Linux 6 Supplementary
flash-plugin-0:11.2.202.577-1.el6_7 cpe:/a:redhat:rhel_extras:6 RHSA-2016:0438 2016-03-11T00:00:00Z

No data.

Project Subscriptions

Vendors Products
Adobe Subscribe
Air Subscribe
Air Desktop Runtime Subscribe
Air Sdk Subscribe
Air Sdk \& Compiler Subscribe
Flash Player Subscribe
Flash Player Desktop Runtime Subscribe
Apple Subscribe
Iphone Os Subscribe
Mac Os X Subscribe
Google Subscribe
Android Subscribe
Chrome Os Subscribe
Linux Subscribe
Linux Kernel Subscribe
Microsoft Subscribe
Windows Subscribe
Windows 10 Subscribe
Windows 8.1 Subscribe
Redhat Subscribe
Rhel Extras Subscribe
Samsung Subscribe
X14j Firmware Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00022.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00023.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00024.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html cve-icon cve-icon
http://www.securityfocus.com/bid/84312 cve-icon cve-icon
http://www.securitytracker.com/id/1035251 cve-icon cve-icon
https://helpx.adobe.com/security/products/flash-player/apsb16-08.html cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2016-0997 cve-icon
https://security.gentoo.org/glsa/201603-07 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2016-0997 cve-icon
https://www.exploit-db.com/exploits/39613/ cve-icon cve-icon
History

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.43916}

 epss

{'score': 0.46399}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2024-08-05T22:38:41.480Z

Reserved: 2015-12-22T00:00:00

Link: CVE-2016-0997

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2016-03-12T15:59:17.870

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-0997

cve-icon Redhat

Severity : Critical

Publid Date: 2016-03-10T00:00:00Z

Links: CVE-2016-0997 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses