Adobe fixes CVE-2016-1019 Zero

CVE-2014-8439 is a memory-safety flaw (CWE-119) in Adobe Flash Player caused by the program's mishandling of a dereferenced memory pointer, allowing access to memory outside the intended bounds. As is typical of Flash memory-corruption bugs, it is triggered when Flash Player processes maliciously crafted content (e.g., a hostile .swf file rendered in a browser or embedded Flash player), which can crash the player or, more seriously, allow attacker-controlled code execution. A successful attacker gains the ability to run arbitrary code with the privileges of the logged-in user, a common route to workstation compromise and follow-on malware deployment. All Adobe Flash Player deployments were in scope at the time of the 2014 disclosure (the source data provides no version range), and because Flash reached end-of-life in December 2020, the population plausibly at risk today consists mainly of unmanaged or legacy endpoints, embedded/bundled enterprise applications, and installations still loading Flash content. Exploitation is confirmed in the wild: CISA added this CVE to the Known Exploited Vulnerabilities catalog on May 25, 2022, and its EPSS score of 20% (97th percentile) indicates a meaningful probability of ongoing or renewed exploitation despite the product's age.

Do: Because Flash Player is end-of-life (since December 31, 2020) and no longer receives security updates, follow CISA's required action: uninstall Flash Player and any remaining browser plugins, or disconnect/isolate systems where it cannot yet be removed, and inventory third-party, intranet, and embedded applications that bundle Flash. Where Flash must remain temporarily, ensure the final release is installed (its post-EOL kill switch blocks most Flash content from running after January 12, 2021, which limits this attack vector), restrict Flash content to trusted sources, and prioritize monitoring given the KEV listing and 20% EPSS score.

CVE-2015-0310 is a protection-mechanism weakness in Adobe Flash Player in which the player fails to properly restrict the discovery of memory addresses, allowing an attacker to defeat Address Space Layout Randomization (ASLR), the mitigation that randomizes where code and data are loaded in memory. It is triggered by running attacker-controlled Flash (SWF) content in a browser, ActiveX control, or embedded player, typically as part of an exploit chain in which the attacker infers module addresses during a heap spray. The flaw grants no code execution by itself; its value to attackers is that it makes memory-corruption exploits deterministic and reliable, and it is generally chained with another Flash vulnerability to achieve remote code execution. Any system still running Adobe Flash Player is affected, a product now end-of-life, so exposure is concentrated in legacy enterprise web applications, kiosks, embedded players, and browser/OS builds that shipped with Flash bundled. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2022-05-25, confirming exploitation in the wild; no public proof-of-concept is known, no CVSS score has been published, and EPSS estimates a 15.2% chance of exploitation within 30 days (97th percentile).

Do: Per CISA's required action, treat Flash as retired: inventory all systems for Flash usage (browser plugins, IE/ActiveX controls, standalone players, and embedded enterprise applications) and remove or disconnect it where found. Where Flash must remain, ensure the latest available Adobe release is installed and restrict execution to trusted SWF content, prioritizing internet-facing endpoints given the KEV listing.

Adobe Flash Player and Adobe AIR contain a use-after-free memory corruption flaw (CWE-416) that allows remote attackers to execute arbitrary code by persuading a user to load specially crafted Flash content, as the CVSS vector (AV:N/UI:R) indicates exploitation via user interaction such as opening a malicious SWF in a browser or an application embedding Flash/AIR. Successful exploitation gives the attacker code execution with the victim user's privileges, with high impact on confidentiality, integrity, and availability. All Flash Player versions before 18.0.0.329, 19.x/20.x before 20.0.0.306 on Windows and OS X, and before 11.2.202.569 on Linux are affected, along with Adobe AIR Desktop Runtime, AIR SDK, and AIR SDK & Compiler before 20.0.0.260. The flaw was fixed in February 2016 as one of several sibling use-after-free bugs (CVE-2016-0973, -0974, -0975, -0982, -0983), and a public proof of concept is available (Exploit-DB 39462). CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-25, confirming known in-the-wild exploitation (ransomware use unknown), and EPSS at 54.8% (99th percentile) indicates continued likelihood of exploitation against remaining exposed systems.

Do: Upgrade Flash Player to 18.0.0.329, or 20.0.0.306 on Windows/macOS and 11.2.202.569 on Linux, and upgrade AIR, AIR SDK, and AIR SDK & Compiler to 20.0.0.260. Because Flash is end-of-life, per CISA KEV guidance the preferred action is to remove or disable Flash entirely and disconnect any system still running it; audit legacy browsers, kiosks, industrial HMIs, and embedded apps that still load SWF content, since exploitation requires user-opened Flash content.

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0999, and CVE-2016-1000.

CVE-2016-1010 is an integer overflow (CWE-190) in Adobe Flash Player and Adobe AIR that allows attackers to execute arbitrary code via unspecified vectors, most plausibly by inducing a user to open attacker-supplied Flash content, consistent with the user-interaction requirement in its CVSS 3.1 score of 8.8. It affects Flash Player before 18.0.0.333 (Extended Support Release) and 19.x through 21.x before 21.0.0.182 on Windows and OS X, Flash Player before 11.2.202.577 on Linux, and Adobe AIR, AIR SDK, and AIR SDK & Compiler releases before 21.0.0.176, with Samsung X14J firmware also listed as an affected bundler of the Flash component. Successful exploitation yields arbitrary code execution in the context of the Flash runtime, typically sufficient to install malware or move laterally under the user's privileges. Anyone still running these now end-of-life runtimes, including embedded deployments such as the Samsung X14J firmware, is exposed. CISA added the flaw to the KEV catalog on 2022-05-25, and related reporting ties Windows zero-day Flash exploitation to targeted attacks by the FruityArmor APT, indicating in-the-wild exploitation; EPSS assigns a 19.4% probability of exploitation within 30 days (97th percentile), though no public PoC is known.

Do: Upgrade Flash Player to 18.0.0.333 (ESR), 21.0.0.182 (Windows/OS X), or 11.2.202.577 (Linux), and Adobe AIR, AIR SDK, and AIR SDK & Compiler to 21.0.0.176. Since all impacted products are end-of-life, CISA's required action is to disconnect them if still in use; prioritize removing or disabling Flash/AIR entirely and verify that no embedded deployments (e.g., Samsung X14J firmware) still rely on Flash. Hunt for signs of targeted exploitation consistent with FruityArmor APT activity, such as unexpected Flash content and suspicious child processes spawned from browsers or Flash-enabled applications.

CVE-2016-1019 is a remotely exploitable flaw in Adobe Flash Player that lets an attacker cause a denial of service or, in the worst case, execute arbitrary code on the victim's system. It is triggered remotely, typically when a user views malicious Flash content delivered through a web browser, an application, or a document that embeds Flash content. A successful attack runs code with the privileges of the logged-on user, making the bug a useful foothold for deploying malware, including ransomware. Anyone still running Adobe Flash Player is potentially affected - the product is end-of-life (support ended December 31, 2020), but it persists on legacy desktops, intranet applications, kiosks, and embedded or industrial systems; the CISA data does not list specific affected version ranges. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on March 3, 2022, notes known ransomware use, and EPSS assigns a 22.5% probability of exploitation in the next 30 days (98th percentile), though no public proof-of-concept is catalogued.

Do: Per CISA's required action, disconnect or remove any system still running Adobe Flash Player, since the product is end-of-life and receives no further security updates; the bug was patched in Adobe's 2016 updates, so only long-unupdated or embedded Flash installs remain vulnerable. Uninstall Flash from browsers and legacy software and confirm that no internal applications or sites still serve or require SWF content. Because exploitation is tied to ransomware campaigns, prioritize user workstations and any internet-facing host with Flash installed.