CVE-2016-0993
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182...
CVE-2016-0993 is a high vulnerability (CVSS 8.8) in Adobe Air, published March 10, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.66%, the 92nd percentile. Fixed in flash-player-plugin 11.2.202.577-1.mga5.nonfree.
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
- Record
CVE-2016-0993- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
- Record
CVE-2016-0993- Updated
- 2026-11-02
EUVDEUVD-2016-1003 No score
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
- Record
EUVD-2016-1003- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3r99-gh2f-23fp
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182...
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
- Record
GHSA-3r99-gh2f-23fp- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-0993
Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux, Adobe AIR before 21.0.0.176, Adobe AIR SDK before 21.0.0.176, and Adobe AIR SDK & Compiler before 21.0.0.176 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2016-0963 and CVE-2016-1010.
- Record
UBUNTU-CVE-2016-0993- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0109 No score
Updated flash-player-plugin packages fix security vulnerability
Adobe Flash Player 11.2.202.577 contains fixes to critical security vulnerabilities found in earlier versions that could potentially allow an attacker to take control of the affected system.
This update resolves integer overflow vulnerabilities that could lead to code execution (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010).
This update resolves use-after-free vulnerabilities that could lead to code execution (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-1000).
This update resolves a heap overflow vulnerability that could lead to code execution (CVE-2016-1001).
This update resolves memory corruption vulnerabilities that could lead to code execution (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-1005).
Adobe reports that an exploit for CVE-2016-1010 is being used in limited, targeted attacks.
- Record
MGASA-2016-0109- Updated
- 2026-11-02
OSVSUSE-SU-2016:0715-1 No score
Security update for flash-player
Adobe flash-player was updated to 11.2.202.577 to fix the following list of security issues (bsc#970547):
These updates resolve integer overflow vulnerabilities that could lead to code execution (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000).
These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2016-1001).
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, CVE-2016-1005).
Adobe advisory with more information: https://helpx.adobe.com/security/products/flash-player/apsb16-08.html
- Record
SUSE-SU-2016:0715-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:0716-1 No score
Security update for flash-player
Adobe flash-player was updated to 11.2.202.577 to fix the following list of security issues (bsc#970547):
These updates resolve integer overflow vulnerabilities that could lead to code execution (CVE-2016-0963, CVE-2016-0993, CVE-2016-1010).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-0987, CVE-2016-0988, CVE-2016-0990, CVE-2016-0991, CVE-2016-0994, CVE-2016-0995, CVE-2016-0996, CVE-2016-0997, CVE-2016-0998, CVE-2016-0999, CVE-2016-1000).
These updates resolve a heap overflow vulnerability that could lead to code execution (CVE-2016-1001).
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0986, CVE-2016-0989, CVE-2016-0992, CVE-2016-1002, CVE-2016-1005).
Adobe advisory with more information: https://helpx.adobe.com/security/products/flash-player/apsb16-08.html
- Record
SUSE-SU-2016:0716-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flash-player-pluginMageia:5 |
before 11.2.202.577-1.mga5.nonfree | 11.2.202.577-1.mga5.nonfree |
flash-pluginRed Hat:rhel_extras:5::client |
before 0:11.2.202.577-1.el5 | 0:11.2.202.577-1.el5 |
flash-pluginRed Hat:rhel_extras:5::server |
before 0:11.2.202.577-1.el5 | 0:11.2.202.577-1.el5 |
flash-pluginRed Hat:rhel_extras:6 |
before 0:11.2.202.577-1.el6_7 | 0:11.2.202.577-1.el6_7 |
flash-playerSUSE:Linux Enterprise Desktop 12 |
before 11.2.202.577-123.1 | 11.2.202.577-123.1 |
flash-playerSUSE:Linux Enterprise Desktop 12 SP1 |
before 11.2.202.577-123.1 | 11.2.202.577-123.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 |
before 11.2.202.577-123.1 | 11.2.202.577-123.1 |
flash-playerSUSE:Linux Enterprise Workstation Extension 12 SP1 |
before 11.2.202.577-123.1 | 11.2.202.577-123.1 |
flash-playerSUSE:Linux Enterprise Desktop 11 SP4 |
before 11.2.202.577-0.38.1 | 11.2.202.577-0.38.1 |
flashplugin-nonfreeUbuntu:14.04:LTS |
before 11.2.202.577ubuntu0.14.04.1, plus listed versions 11.2.202.310ubuntu111.2.202.327ubuntu0.13.10.111.2.202.332ubuntu111.2.202.335ubuntu111.2.202.336ubuntu1 Show 34 moreShow less11.2.202.341ubuntu111.2.202.346ubuntu111.2.202.350ubuntu111.2.202.356ubuntu0.14.04.111.2.202.359ubuntu0.14.04.111.2.202.378ubuntu0.14.04.111.2.202.394ubuntu0.14.04.111.2.202.400ubuntu0.14.04.111.2.202.406ubuntu0.14.04.111.2.202.406ubuntu0.14.04.211.2.202.411ubuntu0.14.04.111.2.202.418ubuntu0.14.04.111.2.202.424ubuntu0.14.04.111.2.202.425ubuntu0.14.04.111.2.202.429ubuntu0.14.04.111.2.202.438ubuntu0.14.04.111.2.202.440ubuntu0.14.04.111.2.202.442ubuntu0.14.04.111.2.202.451ubuntu0.14.04.111.2.202.457ubuntu0.14.04.111.2.202.460ubuntu0.14.04.111.2.202.466ubuntu0.14.04.111.2.202.468ubuntu0.14.04.111.2.202.481ubuntu0.14.04.111.2.202.481ubuntu0.14.04.211.2.202.491ubuntu0.14.04.111.2.202.508ubuntu0.14.04.111.2.202.521ubuntu0.14.04.111.2.202.535ubuntu0.14.04.111.2.202.540ubuntu0.14.04.211.2.202.548ubuntu0.14.04.111.2.202.554ubuntu0.14.04.111.2.202.559ubuntu0.14.04.111.2.202.569ubuntu0.14.04.1 |
11.2.202.577ubuntu0.14.04.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.opensuse.org/opensuse-security-announce/2016-03/msg00032.html
securitytracker.com/id/1035251
security.gentoo.org/glsa/201603-07
helpx.adobe.com/security/products/flash-player/apsb16-08.html
Show 106 moreShow less
securityfocus.com/bid/84308
nvd.nist.gov/vuln/detail/CVE-2016-0993
github.com/advisories/GHSA-3r99-gh2f-23fp
advisories.mageia.org/MGASA-2016-0109.html
bugs.mageia.org/show_bug.cgi?id=17945
access.redhat.com/errata/RHSA-2016:0438
bugzilla.redhat.com/show_bug.cgi?id=1316809
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0438.json
cve.org/CVERecord?id=CVE-2016-0960
cisa.gov/known-exploited-vulnerabilities-catalog
suse.com/support/update/announcement/2016/suse-su-20160715-1
bugzilla.suse.com/970547
ubuntu.com/security/CVE-2016-0993