CVE-2016-0999

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, and CVE-2016-1000.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Mar 12, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-10008.8Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before CVE-2016-10000008.8Ipswitch WhatsUp Gold 16.4.1 WrFreeFormText.asp sUniqueID Parameter Blind SQL Injection CVE-2016-10000017.4flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect CVE-2016-10000022.4gdm3 3.14.2 and possibly later has an information leak before screen lock CVE-2016-10000039.8Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.CVE-2016-10000049.8Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affec CVE-2016-10000059.8mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data we CVE-2016-10000069.8hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param() and ResourceBundle::__construct() functions.CVE-2016-10000076.1Pagure 2.2.1 XSS in raw file endpoint CVE-2016-10000097.5TP-LINK lost control of two domains, www.tplinklogin.net and tplinkextender.net. Please note that these domains are physically printed on ma CVE-2016-10000279.8Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untru CVE-2016-10000284.8Tenable Nessus before 6.8 has a stored XSS issue that requires admin-level authentication to the Nessus UI, and would only potentially impac