{"id":"CVE-2016-1019","aliases":["EUVD-2016-2123","GHSA-mj28-pj3c-6jwr","MGASA-2016-0134","RHSA-2016:0610","SUSE-SU-2016:0990-1","SUSE-SU-2016:1305-1","UBUNTU-CVE-2016-1019"],"status":"published","title":"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service ...","description":"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-06","score":0.22316,"percentile":0.97698,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":true},"published":"2016-04-07T10:00:00Z","modified":"2026-10-01T20:17:16Z","kev":{"date_added":"2022-03-03","due_date":"2022-03-24","required_action":"The impacted product is end-of-life and should be disconnected if still in use.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-03-03"},{"source":"kev","since":"2022-03-03"}],"fixes":[{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"flash-player","fixed_in":["11.2.202.616-126.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"flash-player","fixed_in":["11.2.202.616-126.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"flash-player","fixed_in":["11.2.202.616-126.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"flash-player","fixed_in":["11.2.202.616-126.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["11.2.202.616ubuntu0.14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.616-1.mga5.nonfree"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.616-1.el5"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.616-1.el5"}]}],"bundled":24},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.616-1.el6_7"}]}],"bundled":24},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.616-126.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.616-126.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.616-126.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.616-126.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.621-130.1"}]}],"bundled":49},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.621-130.1"}]}],"bundled":49},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.621-130.1"}]}],"bundled":49},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.621-130.1"}]}],"bundled":49},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.616ubuntu0.14.04.1"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.2","11.2.202.491ubuntu0.14.04.1","11.2.202.508ubuntu0.14.04.1","11.2.202.521ubuntu0.14.04.1","11.2.202.535ubuntu0.14.04.1","11.2.202.540ubuntu0.14.04.2","11.2.202.548ubuntu0.14.04.1","11.2.202.554ubuntu0.14.04.1","11.2.202.559ubuntu0.14.04.1","11.2.202.569ubuntu0.14.04.1","11.2.202.577ubuntu0.14.04.1"]}],"products":[{"vendor":"adobe","product":"air_desktop_runtime"},{"vendor":"adobe","product":"air_sdk"},{"vendor":"adobe","product":"air_sdk_\\\u0026_compiler"},{"vendor":"adobe","product":"flash player"},{"vendor":"adobe","product":"flash_player"},{"vendor":"adobe","product":"flash_player_desktop_runtime"}],"references":[{"url":"https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"https://security.gentoo.org/glsa/201606-08","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsa16-01.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","article","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link"]},{"url":"http://www.securitytracker.com/id/1035491","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link"]},{"url":"http://blogs.adobe.com/psirt/?p=1330","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Vendor Advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0610.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050","tags":["vendor-advisory","x_refsource_MS","x_transferred","Patch","Third Party Advisory","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-10.html","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","article"]},{"url":"http://www.securityfocus.com/bid/85856","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1019","tags":["government-resource","US Government Resource"]},{"url":"https://github.com/cisagov/vulnrichment/issues/196","tags":["issue-tracking","Issue Tracking"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1019","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mj28-pj3c-6jwr"},{"url":"https://advisories.mageia.org/MGASA-2016-0134.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18158","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0610","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1324353","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0610.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1006","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1006","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1006","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1011","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1011","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1011","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1012","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1012","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1012","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1013","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1013","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1013","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1014","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1014","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1014","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1015","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1015","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1015","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1016","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1016","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1016","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1017","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1017","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1018","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1018","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1019","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1019","tags":["advisory","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1020","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1020","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1020","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1021","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1021","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1022","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1022","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1022","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1023","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1024","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1024","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1024","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1025","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1025","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1025","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1026","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1026","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1026","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1027","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1027","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1027","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1028","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1028","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1028","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1029","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1029","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1030","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1030","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1030","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1031","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1031","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1031","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1032","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1032","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1032","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-1033","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1033","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1033","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/974209","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1019","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161305-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/979422","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1017","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1031","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1033","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1096","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1098","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4109","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4110","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4113","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4117","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-1019","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-1019","description":"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.","status":"published","published":"2016-04-07T10:00:00Z","modified":"2026-10-01T19:53:27.202Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:33:35.841056Z"}],"euvd":[{"id":"EUVD-2016-2123","description":"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.","status":"published","published":"2016-04-07T10:00:00Z","modified":"2026-10-01T19:53:27Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"exploited_since":"2022-03-03","updated_at":"2026-11-02T17:27:43.593551Z"}],"ghsa":[{"id":"GHSA-mj28-pj3c-6jwr","title":"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service ...","description":"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.","status":"published","published":"2022-05-14T02:24:41Z","modified":"2025-11-17T21:31:17Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:04:50.199532Z"}],"kev":[{"id":"CVE-2016-1019","title":"Adobe Flash Player Arbitrary Code Execution Vulnerability","description":"Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.","kev":{"date_added":"2022-03-03","due_date":"2022-03-24","required_action":"The impacted product is end-of-life and should be disconnected if still in use.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2016-1019","description":"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.","status":"published","published":"2016-04-07T10:59:01.447Z","modified":"2026-10-01T20:17:16.08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"UBUNTU-CVE-2016-1019","description":"Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.","status":"published","published":"2016-04-07T10:59:00Z","modified":"2025-11-19T16:49:06Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"MGASA-2016-0134","title":"Updated flash-player-plugin packages fix security vulnerabilities","description":"Adobe Flash Player 11.2.202.616 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow\nan attacker to take control of the affected system.\n\nThis update hardens a mitigation against JIT spraying attacks that could\nbe used to bypass memory layout randomization mitigations (CVE-2016-1006).\n\nThis update resolves type confusion vulnerabilities that could lead to code\nexecution (CVE-2016-1015, CVE-2016-1019).\n\nThis update resolves use-after-free vulnerabilities that could lead to code\nexecution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, CVE-2016-1017,\nCVE-2016-1031).\n\nThis update resolves memory corruption vulnerabilities that could lead to code\nexecution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022,\nCVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027,\nCVE-2016-1028, CVE-2016-1029, CVE-2016-1032, CVE-2016-1033).\n\nThis update resolves a stack overflow vulnerability that could lead to code\nexecution (CVE-2016-1018).\n\nThis update resolves a security bypass vulnerability (CVE-2016-1030).\n\nThis update resolves a vulnerability in the directory search path used to find\nresources that could lead to code execution (CVE-2016-1014).\n\nAdobe reports that CVE-2016-1019 is already being actively exploited on Windows\nsystems.\n","status":"published","published":"2016-04-08T06:17:28Z","modified":"2026-04-16T06:23:45.143830275Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2016:0610","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T12:27:44Z","modified":"2026-06-29T10:12:10Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:0990-1","title":"Security update for flash-player","description":"flash-player was updated to fix one security issue.\n\nThis security issue was fixed:\n- CVE-2016-1019: Adobe Flash Player allowed remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016 (bsc#974209).\n  ","status":"published","published":"2016-04-08T11:31:41Z","modified":"2026-02-04T04:23:21.028716Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1305-1","title":"Security update for flash-player","description":"\nThis update for flash-player fixes the following issues: \n\n- Security update to 11.2.202.621 (bsc#979422):\n  * APSA16-02, APSB16-15, CVE-2016-1096, CVE-2016-1097,\n    CVE-2016-1098, CVE-2016-1099, CVE-2016-1100, CVE-2016-1101,\n    CVE-2016-1102, CVE-2016-1103, CVE-2016-1104, CVE-2016-1105,\n    CVE-2016-1106, CVE-2016-1107, CVE-2016-1108, CVE-2016-1109,\n    CVE-2016-1110, CVE-2016-4108, CVE-2016-4109, CVE-2016-4110,\n    CVE-2016-4111, CVE-2016-4112, CVE-2016-4113, CVE-2016-4114,\n    CVE-2016-4115, CVE-2016-4116, CVE-2016-4117\n\n- The following CVEs got fixed during the previous release, but\n  got published afterwards:\n  * APSA16-01, APSB16-10, CVE-2016-1006, CVE-2016-1011,\n    CVE-2016-1012, CVE-2016-1013, CVE-2016-1014, CVE-2016-1015,\n    CVE-2016-1016, CVE-2016-1017, CVE-2016-1018, CVE-2016-1019,\n    CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023,\n    CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027,\n    CVE-2016-1028, CVE-2016-1029, CVE-2016-1030, CVE-2016-1031,\n    CVE-2016-1032, CVE-2016-1033","status":"published","published":"2016-05-16T12:14:28Z","modified":"2026-02-04T02:27:21.948173Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}