{"id":"CVE-2016-4280","aliases":["EUVD-2016-5280","GHSA-p3qw-4fr9-22cj","MGASA-2016-0315","RHSA-2016:1865","SUSE-SU-2016:2312-1"],"status":"published","title":"Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X...","description":"Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04434,"percentile":0.91447,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-787"],"published":"2016-09-14T18:00:00Z","modified":"2026-06-29T10:13:46Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.635-1.mga5.nonfree"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.635-1.el5_11"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.635-1.el5_11"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.635-1.el6_8"}]}],"bundled":26},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.635-140.1"}]}],"bundled":29},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.635-140.1"}]}],"bundled":29}],"products":[{"vendor":"adobe","product":"flash_player"},{"vendor":"adobe","product":"flash_player_desktop_runtime"}],"references":[{"url":"https://security.gentoo.org/glsa/201610-10","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-29.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-1865.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/92930","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1036791","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4280","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p3qw-4fr9-22cj"},{"url":"https://advisories.mageia.org/MGASA-2016-0315.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19359","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:1865","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375725","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1865.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4271","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4271","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4272","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4272","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4272","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4274","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4274","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4274","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4275","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4275","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4275","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4276","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4276","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4277","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4277","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4277","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4278","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4278","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4278","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4279","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4279","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4279","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4280","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4280","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4281","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4281","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4282","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4282","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4282","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4283","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4284","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4284","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4285","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4285","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-4287","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-4287","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4287","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6921","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6921","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6922","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6922","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6922","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6923","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6923","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6923","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6924","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6924","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6925","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6925","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6926","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6926","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6926","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6927","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6927","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6927","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6929","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6930","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6930","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6931","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6931","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6931","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-6932","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-6932","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6932","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162312-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/998589","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4272","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4274","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4276","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4278","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4279","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4280","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4282","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4283","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4287","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6932","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4280","description":"Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.","status":"published","published":"2016-09-14T18:00:00Z","modified":"2024-08-06T00:25:13.859Z","updated_at":"2026-11-02T14:33:34.815789Z"}],"euvd":[{"id":"EUVD-2016-5280","description":"Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.","status":"published","published":"2016-09-14T18:00:00Z","modified":"2024-08-06T00:25:13Z","updated_at":"2026-11-03T02:22:47.294859Z"}],"ghsa":[{"id":"GHSA-p3qw-4fr9-22cj","title":"Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X...","description":"Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.","status":"published","published":"2022-05-14T03:57:19Z","modified":"2023-01-31T05:08:11Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119","CWE-787"],"updated_at":"2026-11-02T14:49:21.399059Z"}],"nvd":[{"id":"CVE-2016-4280","description":"Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, and CVE-2016-6924.","status":"published","published":"2016-09-14T18:59:10.2Z","modified":"2026-06-17T00:47:16.673Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:03:29.893676Z"}],"osv":[{"id":"RHSA-2016:1865","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T14:37:29Z","modified":"2026-06-29T10:13:46Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"MGASA-2016-0315","title":"Updated flash-player-plugin packages fix security vulnerability","description":"Adobe Flash Player 11.2.202.635 contains fixes to critical security\nvulnerabilities found in earlier versions that could potentially allow an\nattacker to take control of the affected system.\n\nThis update resolves an integer overflow vulnerability that could lead to\ncode execution (CVE-2016-4287). \n\nThis update resolves use-after-free vulnerabilities that could lead to\ncode execution (CVE-2016-4272, CVE-2016-4279, CVE-2016-6921,\nCVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929,\nCVE-2016-6930, CVE-2016-6931, CVE-2016-6932). \n\nThis update resolves security bypass vulnerabilities that could lead to\ninformation disclosure (CVE-2016-4271, CVE-2016-4277, CVE-2016-4278). \n\nThis update resolves memory corruption vulnerabilities that could lead to\ncode execution (CVE-2016-4274, CVE-2016-4275, CVE-2016-4276,\nCVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284,\nCVE-2016-4285, CVE-2016-6922, CVE-2016-6924).\n","status":"published","published":"2016-09-21T20:38:22Z","modified":"2026-04-16T06:22:56.667367251Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2016:2312-1","title":"Security update for flash-player","description":"This update for flash-player fixes the following security issues (APSB16-29, boo#998589):\n\n- integer overflow vulnerability that could lead to code execution (CVE-2016-4287). \n- use-after-free vulnerabilities that could lead to code execution (CVE-2016-4272, CVE-2016-4279, CVE-2016-6921, CVE-2016-6923, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932)\n- security bypass vulnerabilities that could lead to information disclosure (CVE-2016-4271, CVE-2016-4277, CVE-2016-4278)\n- memory corruption vulnerabilities that could lead to code execution (CVE-2016-4182, CVE-2016-4237, CVE-2016-4238, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-6922, CVE-2016-6924)\n","status":"published","published":"2016-09-15T08:40:57Z","modified":"2026-02-04T04:20:31.742232Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}