CVE-2016-1014

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Untrusted search path vulnerability in Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows local users to gain privileges via a Trojan horse resource in an unspecified directory.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.htmlBroken Link, Third Party Advisory
http://packetstormsecurity.com/files/137532/Adobe-Flash-Player-DLL-Hijacking.htmlThird Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-0610.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2016/Jun/39Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/538699/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035509Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-10.htmlPatch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.htmlBroken Link, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.htmlBroken Link, Third Party Advisory
http://packetstormsecurity.com/files/137532/Adobe-Flash-Player-DLL-Hijacking.htmlThird Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2016-0610.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2016/Jun/39Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/538699/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1035509Broken Link, Third Party Advisory, VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050Patch, Third Party Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-10.htmlPatch, Vendor Advisory

Timeline

Published: Apr 9, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-101407.5Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 CVE-2016-101419.8An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. MuJS before fa3d30fd18c348bb4b1 CVE-2016-101428.6An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. (The scope of this CVE is all aff CVE-2016-101437.5A vulnerability in Tiki Wiki CMS 15.2 could allow a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a CVE-2016-101449.8coders/ipl.c in ImageMagick allows remote attackers to have unspecific impact by leveraging a missing malloc check.CVE-2016-101459.8Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.CVE-2016-101467.5Multiple memory leaks in the caption and label handling code in ImageMagick allow remote attackers to cause a denial of service (memory cons CVE-2016-101475.5crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system cras CVE-2016-101484.3The wp_ajax_update_plugin function in wp-admin/includes/ajax-actions.php in WordPress before 4.6 makes a get_plugin_data call before checkin CVE-2016-101497.5XML External Entity (XXE) vulnerability in PySAML2 4.4.0 and earlier allows remote attackers to read arbitrary files via a crafted SAML XML CVE-2016-10158.8Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows att CVE-2016-101509.8Use-after-free vulnerability in the kvm_ioctl_create_device function in virt/kvm/kvm_main.c in the Linux kernel before 4.8.13 allows host OS