{"id":"CVE-2016-7859","aliases":["EUVD-2016-8708","GHSA-955x-p5qj-g2mp","MGASA-2016-0370","RHSA-2016:2676","SUSE-SU-2016:2778-1","UBUNTU-CVE-2016-7859"],"status":"published","title":"Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable...","description":"Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.07041,"percentile":0.94229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2016-11-08T17:45:00Z","modified":"2026-06-29T10:14:29Z","fixes":[{"ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","fixed_in":["11.2.202.644ubuntu0.14.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","fixed_in":["11.2.202.644ubuntu0.16.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"flash-player-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.644-1.mga5.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::client","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.644-1.el5_11"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:5::server","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.644-1.el5_11"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_extras:6","package":"flash-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.2.202.644-1.el6_8"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.644-149.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP1","package":"flash-player","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.644-149.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.644ubuntu0.14.04.1"}]}],"versions":["11.2.202.310ubuntu1","11.2.202.327ubuntu0.13.10.1","11.2.202.332ubuntu1","11.2.202.335ubuntu1","11.2.202.336ubuntu1","11.2.202.341ubuntu1","11.2.202.346ubuntu1","11.2.202.350ubuntu1","11.2.202.356ubuntu0.14.04.1","11.2.202.359ubuntu0.14.04.1","11.2.202.378ubuntu0.14.04.1","11.2.202.394ubuntu0.14.04.1","11.2.202.400ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.1","11.2.202.406ubuntu0.14.04.2","11.2.202.411ubuntu0.14.04.1","11.2.202.418ubuntu0.14.04.1","11.2.202.424ubuntu0.14.04.1","11.2.202.425ubuntu0.14.04.1","11.2.202.429ubuntu0.14.04.1","11.2.202.438ubuntu0.14.04.1","11.2.202.440ubuntu0.14.04.1","11.2.202.442ubuntu0.14.04.1","11.2.202.451ubuntu0.14.04.1","11.2.202.457ubuntu0.14.04.1","11.2.202.460ubuntu0.14.04.1","11.2.202.466ubuntu0.14.04.1","11.2.202.468ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.1","11.2.202.481ubuntu0.14.04.2","11.2.202.491ubuntu0.14.04.1","11.2.202.508ubuntu0.14.04.1","11.2.202.521ubuntu0.14.04.1","11.2.202.535ubuntu0.14.04.1","11.2.202.540ubuntu0.14.04.2","11.2.202.548ubuntu0.14.04.1","11.2.202.554ubuntu0.14.04.1","11.2.202.559ubuntu0.14.04.1","11.2.202.569ubuntu0.14.04.1","11.2.202.577ubuntu0.14.04.1","11.2.202.616ubuntu0.14.04.1","11.2.202.621ubuntu0.14.04.1","11.2.202.626ubuntu0.14.04.1","11.2.202.632ubuntu0.14.04.1","11.2.202.635ubuntu0.14.04.1","11.2.202.637ubuntu0.14.04.1","11.2.202.643ubuntu0.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"flashplugin-nonfree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.2.202.644ubuntu0.16.04.1"}]}],"versions":["11.2.202.540ubuntu2","11.2.202.548ubuntu1","11.2.202.554ubuntu1","11.2.202.559ubuntu1","11.2.202.569ubuntu1","11.2.202.577ubuntu1","11.2.202.616ubuntu1","11.2.202.621ubuntu0.16.04.1","11.2.202.626ubuntu0.16.04.1","11.2.202.632ubuntu0.16.04.1","11.2.202.635ubuntu0.16.04.1","11.2.202.637ubuntu0.16.04.1","11.2.202.643ubuntu0.16.04.1"]}],"products":[{"vendor":"adobe","product":"flash_player"},{"vendor":"adobe","product":"flash_player_for_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-141","tags":["vendor-advisory","x_refsource_MS","x_transferred","Patch","Vendor Advisory"]},{"url":"https://helpx.adobe.com/security/products/flash-player/apsb16-37.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","article","report"]},{"url":"http://www.securityfocus.com/bid/94153","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-2676.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory"]},{"url":"http://www.zerodayinitiative.com/advisories/ZDI-16-602","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1037240","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://security.gentoo.org/glsa/201611-18","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7859","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-955x-p5qj-g2mp"},{"url":"https://advisories.mageia.org/MGASA-2016-0370.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19741","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2016:2676","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1393087","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_2676.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7857","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7857","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7858","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7858","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7858","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7859","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7860","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7860","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7861","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7861","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7862","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7862","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7863","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7863","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7864","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7864","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7865","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7865","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162778-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1009217","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7865","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-7859","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2016-7859","description":"Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2016-11-08T17:45:00Z","modified":"2024-08-06T02:13:20.159Z","updated_at":"2026-11-02T14:33:36.483151Z"}],"euvd":[{"id":"EUVD-2016-8708","description":"Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2016-11-08T17:45:00Z","modified":"2024-08-06T02:13:20Z","updated_at":"2026-11-03T02:22:31.485682Z"}],"ghsa":[{"id":"GHSA-955x-p5qj-g2mp","title":"Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable...","description":"Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2022-05-14T01:01:34Z","modified":"2023-02-02T05:03:07Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:51:34.49846Z"}],"nvd":[{"id":"CVE-2016-7859","description":"Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2016-11-08T17:59:03.38Z","modified":"2026-06-17T00:53:37.09Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:03:32.086916Z"}],"osv":[{"id":"RHSA-2016:2676","title":"Red Hat Security Advisory: flash-plugin security update","status":"published","published":"2024-09-13T14:38:06Z","modified":"2026-06-29T10:14:29Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"UBUNTU-CVE-2016-7859","description":"Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution.","status":"published","published":"2016-11-08T17:59:00Z","modified":"2025-07-16T07:35:05.716483Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:12.994319Z"},{"id":"MGASA-2016-0370","title":"Updated flash-player-plugin packages fix security vulnerabilities","description":"Adobe Flash Player 11.2.202.644 contains fixes to critical security \nvulnerabilities found in earlier versions that could potentially allow an \nattacker to take control of the affected system.\n\nThis update resolves type confusion vulnerabilities that could lead to code \nexecution (CVE-2016-7860, CVE-2016-7861, CVE-2016-7865).\n\nThis update resolves use-after-free vulnerabilities that could lead to code \nexecution (CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7862, \nCVE-2016-7863, CVE-2016-7864).\n","status":"published","published":"2016-11-09T17:05:01Z","modified":"2026-04-16T06:22:23.096548466Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2016:2778-1","title":"Security update for flash-player","description":"This update to Adobe Flash Player 11.2.202.644 fixes the following security issues:\n\n- type confusion vulnerabilities that could lead to code execution\n  (CVE-2016-7860, CVE-2016-7861, CVE-2016-7865)\n- use-after-free vulnerabilities that could lead to code execution\n  (CVE-2016-7857, CVE-2016-7858, CVE-2016-7859, CVE-2016-7862, CVE-2016-7863, CVE-2016-7864)\n","status":"published","published":"2016-11-11T12:30:30Z","modified":"2026-02-04T03:25:24.07348Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}