CVE-2016-1013

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-1011, CVE-2016-1016, CVE-2016-1017, and CVE-2016-1031.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0610.htmlThird Party Advisory
http://www.securityfocus.com/bid/85926Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035509Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-10.htmlPatch, Vendor Advisory
https://www.exploit-db.com/exploits/39778/Exploit, Third Party Advisory, VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.htmlBroken Link, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2016-0610.htmlThird Party Advisory
http://www.securityfocus.com/bid/85926Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035509Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-10.htmlPatch, Vendor Advisory
https://www.exploit-db.com/exploits/39778/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Apr 9, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-101305.9The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to CVE-2016-101319.8system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the emai CVE-2016-101327.5regexp.c in Artifex Software, Inc. MuJS allows attackers to cause a denial of service (NULL pointer dereference and crash) via vectors relat CVE-2016-101339.8Heap-based buffer overflow in the js_stackoverflow function in jsrun.c in Artifex Software, Inc. MuJS allows attackers to have unspecified i CVE-2016-101349.8SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the t CVE-2016-101355.5An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU CVE-2016-101367.8An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoPr CVE-2016-101377.8An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The content provider named com.adups.fota.sysoper.provider.InfoPr CVE-2016-101387.8An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed a CVE-2016-101397.8An issue was discovered on BLU R1 HD devices with Shanghai Adups software. The two package names involved in the exfiltration are com.adups.CVE-2016-10147.3Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and CVE-2016-101407.5Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30