CVE-2016-1012

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, and CVE-2016-1033.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0610.htmlThird Party Advisory
http://www.securityfocus.com/bid/85932Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035509Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-10.htmlPatch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0610.htmlThird Party Advisory
http://www.securityfocus.com/bid/85932Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035509Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-10.htmlPatch, Vendor Advisory

Timeline

Published: Apr 9, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-101207.8Firejail uses 0777 permissions when mounting (1) /dev, (2) /dev/shm, (3) /var/tmp, or (4) /var/lock, which allows local users to gain privil CVE-2016-101217.8Firejail uses weak permissions for /dev/shm/firejail and possibly other files, which allows local users to gain privileges.CVE-2016-101227.8Firejail does not properly clean environment variables, which allows local users to gain privileges.CVE-2016-101237.8Firejail allows --chroot when seccomp is not supported, which might allow local users to gain privileges.CVE-2016-101248.6An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape CVE-2016-101258.1D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which allows man-in-the-middle attackers to spoof dev CVE-2016-101269.8Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and CVE-2016-101279.0PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.CVE-2016-101289.8Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and CVE-2016-101297.5The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL CVE-2016-10138.8Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before CVE-2016-101305.9The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to