ByteOS

Product:Flash Player

Added At:03 Mar, 2022

Due At:24 Mar, 2022

Adobe Flash Player Arbitrary Code Execution Vulnerability

Adobe Flash Player allows remote attackers to cause a denial of service or possibly execute arbitrary code.

Used in Ransomware

Known

CWE

N/A

Required Action:

The impacted product is end-of-life and should be disconnected if still in use.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2016-1019

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:07 Apr, 2016 | 10:00

Updated At:17 Nov, 2025 | 19:47

▼CVE Numbering Authority (CNA)

Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unspecified vectors, as exploited in the wild in April 2016.

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html	x_refsource_MISC
https://security.gentoo.org/glsa/201606-08	vendor-advisory x_refsource_GENTOO
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html	vendor-advisory x_refsource_SUSE
https://helpx.adobe.com/security/products/flash-player/apsa16-01.html	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html	vendor-advisory x_refsource_SUSE
http://www.securitytracker.com/id/1035491	vdb-entry x_refsource_SECTRACK
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html	vendor-advisory x_refsource_SUSE
http://blogs.adobe.com/psirt/?p=1330	x_refsource_CONFIRM
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html	vendor-advisory x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html	vendor-advisory x_refsource_SUSE
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html	vendor-advisory x_refsource_SUSE
http://rhn.redhat.com/errata/RHSA-2016-0610.html	vendor-advisory x_refsource_REDHAT
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050	vendor-advisory x_refsource_MS
https://helpx.adobe.com/security/products/flash-player/apsb16-10.html	x_refsource_CONFIRM
http://www.securityfocus.com/bid/85856	vdb-entry x_refsource_BID

Hyperlink: https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html

Resource:

x_refsource_MISC

Hyperlink: https://security.gentoo.org/glsa/201606-08

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsa16-01.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://www.securitytracker.com/id/1035491

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://blogs.adobe.com/psirt/?p=1330

Resource:

x_refsource_CONFIRM

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html

Resource:

vendor-advisory

x_refsource_SUSE

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-0610.html

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050

Resource:

vendor-advisory

x_refsource_MS

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsb16-10.html

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securityfocus.com/bid/85856

Resource:

vdb-entry

x_refsource_BID

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html	x_refsource_MISC x_transferred
https://security.gentoo.org/glsa/201606-08	vendor-advisory x_refsource_GENTOO x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html	vendor-advisory x_refsource_SUSE x_transferred
https://helpx.adobe.com/security/products/flash-player/apsa16-01.html	x_refsource_CONFIRM x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html	vendor-advisory x_refsource_SUSE x_transferred
http://www.securitytracker.com/id/1035491	vdb-entry x_refsource_SECTRACK x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html	vendor-advisory x_refsource_SUSE x_transferred
http://blogs.adobe.com/psirt/?p=1330	x_refsource_CONFIRM x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html	vendor-advisory x_refsource_SUSE x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html	vendor-advisory x_refsource_SUSE x_transferred
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html	vendor-advisory x_refsource_SUSE x_transferred
http://rhn.redhat.com/errata/RHSA-2016-0610.html	vendor-advisory x_refsource_REDHAT x_transferred
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050	vendor-advisory x_refsource_MS x_transferred
https://helpx.adobe.com/security/products/flash-player/apsb16-10.html	x_refsource_CONFIRM x_transferred
http://www.securityfocus.com/bid/85856	vdb-entry x_refsource_BID x_transferred

Hyperlink: https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://security.gentoo.org/glsa/201606-08

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsa16-01.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://www.securitytracker.com/id/1035491

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://blogs.adobe.com/psirt/?p=1330

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html

Resource:

vendor-advisory

x_refsource_SUSE

x_transferred

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-0610.html

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050

Resource:

vendor-advisory

x_refsource_MS

x_transferred

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsb16-10.html

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securityfocus.com/bid/85856

Resource:

vdb-entry

x_refsource_BID

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-noinfo	CWE-noinfo Not enough information

Type: CWE

CWE ID: CWE-noinfo

Description: CWE-noinfo Not enough information

Metrics

Version	Base score	Base severity	Vector
3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2022-03-03

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1019

References

Hyperlink	Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1019	government-resource
https://github.com/cisagov/vulnrichment/issues/196	issue-tracking

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1019

Resource:

government-resource

Hyperlink: https://github.com/cisagov/vulnrichment/issues/196

Resource:

issue-tracking

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@adobe.com

Published At:07 Apr, 2016 | 10:59

Updated At:21 Apr, 2026 | 21:08

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2022-03-03	2022-03-24	Adobe Flash Player Arbitrary Code Execution Vulnerability	The impacted product is end-of-life and should be disconnected if still in use.

Date Added: 2022-03-03

Due Date: 2022-03-24

Vulnerability Name: Adobe Flash Player Arbitrary Code Execution Vulnerability

Required Action: The impacted product is end-of-life and should be disconnected if still in use.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 10.0

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:a:adobe:flash_player_desktop_runtime:*:*:*:*:*:*:*:*

>>flash_player_desktop_runtime>>Versions up to 21.0.0.197(inclusive)

>>mac_os_x>>-

>>windows>>-

cpe:2.3:a:adobe:flash_player:*:*:*:*:esr:*:*:*

>>flash_player>>Versions up to 18.0.0.333(inclusive)

>>mac_os_x>>-

>>windows>>-

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:chrome:*:*

>>flash_player>>Versions up to 21.0.0.197(inclusive)

>>mac_os_x>>-

cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*

Google LLC

>>chrome_os>>-

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

>>windows>>-

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*

>>flash_player>>Versions up to 21.0.0.197(inclusive)

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

>>windows_10>>-

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:internet_explorer:*:*

>>flash_player>>Versions up to 21.0.0.197(inclusive)

cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*

>>windows_10>>-

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

>>windows_8.1>>-

cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*

>>flash_player>>Versions up to 11.2.202.577(inclusive)

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

cpe:2.3:a:adobe:air_desktop_runtime:*:*:*:*:*:*:*:*

>>air_desktop_runtime>>Versions up to 21.0.0.176(inclusive)

>>mac_os_x>>-

>>windows>>-

cpe:2.3:a:adobe:air_sdk:*:*:*:*:*:*:*:*

>>air_sdk>>Versions up to 21.0.0.176(inclusive)

cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*

>>iphone_os>>-

>>mac_os_x>>-

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

Google LLC

>>android>>-

>>windows>>-

cpe:2.3:a:adobe:air_sdk_\&_compiler:*:*:*:*:*:*:*:*

>>air_sdk_\&_compiler>>Versions up to 21.0.0.176(inclusive)

cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*

>>iphone_os>>-

>>mac_os_x>>-

cpe:2.3:o:google:android:-:*:*:*:*:*:*:*

Google LLC

>>android>>-

>>windows>>-

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://blogs.adobe.com/psirt/?p=1330	psirt@adobe.com	Broken Link Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html	psirt@adobe.com	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html	psirt@adobe.com	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html	psirt@adobe.com	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html	psirt@adobe.com	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html	psirt@adobe.com	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html	psirt@adobe.com	Broken Link
http://rhn.redhat.com/errata/RHSA-2016-0610.html	psirt@adobe.com	Third Party Advisory
http://www.securityfocus.com/bid/85856	psirt@adobe.com	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035491	psirt@adobe.com	Broken Link Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050	psirt@adobe.com	Patch Third Party Advisory Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsa16-01.html	psirt@adobe.com	Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-10.html	psirt@adobe.com	Vendor Advisory
https://security.gentoo.org/glsa/201606-08	psirt@adobe.com	Third Party Advisory
https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html	psirt@adobe.com	Broken Link
http://blogs.adobe.com/psirt/?p=1330	af854a3a-2127-422b-91ae-364da2661108	Broken Link Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
http://rhn.redhat.com/errata/RHSA-2016-0610.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
http://www.securityfocus.com/bid/85856	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1035491	af854a3a-2127-422b-91ae-364da2661108	Broken Link Third Party Advisory VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050	af854a3a-2127-422b-91ae-364da2661108	Patch Third Party Advisory Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsa16-01.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://helpx.adobe.com/security/products/flash-player/apsb16-10.html	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://security.gentoo.org/glsa/201606-08	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html	af854a3a-2127-422b-91ae-364da2661108	Broken Link
https://github.com/cisagov/vulnrichment/issues/196	134c704f-9b21-4f2e-91b3-4a467353bcc0	Issue Tracking
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1019	134c704f-9b21-4f2e-91b3-4a467353bcc0	US Government Resource

Hyperlink: http://blogs.adobe.com/psirt/?p=1330

Source: psirt@adobe.com

Resource:

Broken Link

Vendor Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-0610.html

Source: psirt@adobe.com

Resource:

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/85856

Source: psirt@adobe.com

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1035491

Source: psirt@adobe.com

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050

Source: psirt@adobe.com

Resource:

Patch

Third Party Advisory

Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsa16-01.html

Source: psirt@adobe.com

Resource:

Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsb16-10.html

Source: psirt@adobe.com

Resource:

Vendor Advisory

Hyperlink: https://security.gentoo.org/glsa/201606-08

Source: psirt@adobe.com

Resource:

Third Party Advisory

Hyperlink: https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html

Source: psirt@adobe.com

Resource:

Broken Link

Hyperlink: http://blogs.adobe.com/psirt/?p=1330

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Vendor Advisory

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00009.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00010.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00012.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00055.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: http://rhn.redhat.com/errata/RHSA-2016-0610.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: http://www.securityfocus.com/bid/85856

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: http://www.securitytracker.com/id/1035491

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Third Party Advisory

VDB Entry

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-050

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Third Party Advisory

Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsa16-01.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://helpx.adobe.com/security/products/flash-player/apsb16-10.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://security.gentoo.org/glsa/201606-08

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

Hyperlink: https://www.fireeye.com/blog/threat-research/2016/04/cve-2016-1019_a_new.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Broken Link

Hyperlink: https://github.com/cisagov/vulnrichment/issues/196

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

Issue Tracking

Hyperlink: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1019

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

US Government Resource

Similar CVEs

7157Records found

CVE-2019-7084

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.41% / 90.33%

7 Day CHG~0.00%

Published-24 May, 2019 | 18:56

Updated-04 Aug, 2024 | 20:38

Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2015-8430

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-43.41% / 98.60%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-8429

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-43.41% / 98.60%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows flash_player iphone_os air_sdk android air air_sdk_\&_compiler n/a

CVE-2015-8405

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-5.75% / 92.28%

7 Day CHG-0.02%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows iphone_os flash_player air_sdk android air air_sdk_\&_compiler n/a

CVE-2019-7104

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-5.07% / 91.43%

7 Day CHG~0.00%

Published-23 May, 2019 | 15:45

Updated-04 Aug, 2024 | 20:38

Adobe Shockwave Player versions 12.3.4.204 and earlier have a memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Vendor-Adobe Inc.

Product-shockwave_player Adobe Shockwave Player

CWE ID-CWE-787

Out-of-bounds Write

CVE-2015-8659

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-10||CRITICAL

EPSS-4.07% / 89.63%

7 Day CHG~0.00%

Published-12 Jan, 2016 | 19:00

Updated-06 May, 2026 | 22:30

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.

Vendor-nghttp2 n/a Apple Inc.

Product-mac_os_x nghttp2 iphone_os tvos watchos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-7112

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.91% / 91.20%

7 Day CHG~0.00%

Published-23 May, 2019 | 16:55

Updated-04 Aug, 2024 | 20:38

Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2015-8422

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-43.41% / 98.61%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air windows iphone_os flash_player air_sdk android linux_kernel air_sdk_\&_compiler n/a

CVE-2015-8423

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-43.41% / 98.60%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air windows iphone_os flash_player air_sdk android linux_kernel air_sdk_\&_compiler n/a

CVE-2015-8457

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-9.01% / 94.72%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Stack-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8407.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air windows iphone_os flash_player air_sdk android linux_kernel air_sdk_\&_compiler n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8440

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-5.57% / 92.04%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows flash_player iphone_os air_sdk android air air_sdk_\&_compiler n/a

CVE-2019-8061

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-4.33% / 90.18%

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:08

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2015-8415

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-9.41% / 94.89%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-7805

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-6.53% / 93.06%

7 Day CHG~0.00%

Published-22 May, 2019 | 15:04

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2015-8408

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-5.31% / 91.74%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-8001

Matching Score-8

Matching Score-8

CVSS Score-9.8||CRITICAL

EPSS-6.43% / 92.99%

7 Day CHG~0.00%

Published-26 Aug, 2019 | 18:56

Updated-04 Aug, 2024 | 21:02

Adobe Photoshop CC versions 19.1.8 and earlier and 20.0.5 and earlier have an out of bound write vulnerability. Successful exploitation could lead to arbitrary code execution.

Product-windows photoshop_cc macos Adobe Photoshop CC

CWE ID-CWE-787

Out-of-bounds Write

CVE-2015-9067

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.97%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed.

CVE-2015-9063

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-1.06% / 60.91%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a procedure involving a remote UIM client.

Product-android Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8416

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-7.09% / 93.55%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8961

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-2.00% / 78.65%

7 Day CHG~0.00%

Published-16 Nov, 2016 | 04:49

Updated-06 May, 2026 | 22:30

The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.

Vendor-n/a Linux Kernel Organization, Inc

Product-linux_kernel n/a

CWE ID-CWE-416

Use After Free

CVE-2015-8421

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-43.41% / 98.61%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows flash_player iphone_os air_sdk android air air_sdk_\&_compiler n/a

CVE-2015-9037

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.97%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read may occur in the processing of a downlink 3G NAS message.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-9051

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.97%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.

CWE ID-CWE-20

Improper Input Validation

CVE-2015-9048

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.97%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of lost RTP packets.

CWE ID-CWE-20

Improper Input Validation

CVE-2015-9073

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.98%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2015-9066

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-1.06% / 60.91%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in an Inter-RAT procedure.

Product-android Snapdragon Mobile

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-9036

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.97%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memory getting corrupted.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-9040

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.80% / 53.02%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in a GERAN API.

CWE ID-CWE-284

Improper Access Control

CVE-2015-9061

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.97%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, playReady DRM failed to check a length potentially leading to unauthorized access to secure memory.

CWE ID-CWE-20

Improper Input Validation

CVE-2015-9047

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.80% / 53.02%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in GNSS when performing a scan after bootup.

CWE ID-CWE-284

Improper Access Control

CVE-2015-9011

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-9.8||CRITICAL

EPSS-1.15% / 63.71%

7 Day CHG~0.00%

Published-04 Apr, 2018 | 18:00

Updated-17 Sep, 2024 | 01:16

An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882.

Vendor-Google LLC

Product-android Android

CWE ID-CWE-264

Not Available

CVE-2015-8967

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-7.8||HIGH

EPSS-0.83% / 53.89%

7 Day CHG~0.00%

Published-08 Dec, 2016 | 21:00

Updated-06 May, 2026 | 22:30

arch/arm64/kernel/sys.c in the Linux kernel before 4.0 allows local users to bypass the "strict page permissions" protection mechanism and modify the system-call table, and consequently gain privileges, by leveraging write access.

Vendor-n/a Google LLC Linux Kernel Organization, Inc

Product-android linux_kernel n/a

CVE-2015-8411

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-31.63% / 98.11%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-8409

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-4.82% / 91.04%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows iphone_os flash_player air_sdk android air air_sdk_\&_compiler n/a

CVE-2015-8428

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-43.41% / 98.60%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air windows flash_player iphone_os air_sdk android linux_kernel air_sdk_\&_compiler n/a

CVE-2015-8418

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-6.13% / 92.70%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8592

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.81% / 53.08%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not validated prior to being dereferenced potentially resulting in Guest-OS memory corruption.

CWE ID-CWE-476

NULL Pointer Dereference

CVE-2015-8595

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.97%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in digital television/digital radio DRM.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-9014

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-9.8||CRITICAL

EPSS-1.40% / 69.75%

7 Day CHG~0.00%

Published-04 Apr, 2018 | 18:00

Updated-16 Sep, 2024 | 22:03

An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750.

Vendor-Google LLC

Product-android Android

CWE ID-CWE-264

Not Available

CVE-2015-8419

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-6.13% / 92.70%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8443, CVE-2015-8444, CVE-2015-8451, and CVE-2015-8455.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air windows flash_player iphone_os air_sdk android linux_kernel air_sdk_\&_compiler n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8594

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-1.09% / 62.11%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in RFA-1x.

Product-android Snapdragon Mobile, Snapdragon Wear

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2019-19166

Matching Score-8

Assigner-KrCERT/CC

Matching Score-8

Assigner-KrCERT/CC

CVSS Score-7.8||HIGH

EPSS-0.39% / 31.87%

7 Day CHG~0.00%

Published-06 May, 2020 | 12:44

Updated-05 Aug, 2024 | 02:09

Tobesoft XPlatform Arbitrary File Execution Vulnerability

Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution.

Vendor-tobesoft Tobesoft Microsoft Corporation

Product-windows xplatform XPlatform

CWE ID-CWE-494

Download of Code Without Integrity Check

CVE-2015-8406

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-5.79% / 92.33%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-8596

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.97%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, validation of buffer lengths is missing in malware protection.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8451

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-6.13% / 92.70%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8045, CVE-2015-8047, CVE-2015-8060, CVE-2015-8408, CVE-2015-8416, CVE-2015-8417, CVE-2015-8418, CVE-2015-8419, CVE-2015-8443, CVE-2015-8444, and CVE-2015-8455.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-9012

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

Matching Score-8

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-9.8||CRITICAL

EPSS-1.13% / 63.07%

7 Day CHG~0.00%

Published-04 Apr, 2018 | 18:00

Updated-16 Sep, 2024 | 18:08

An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691.

Vendor-Google LLC

Product-android Android

CWE ID-CWE-264

Not Available

CVE-2015-8431

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-43.41% / 98.60%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-mac_os_x air_sdk_\&_compiler windows flash_player iphone_os air_sdk android air linux_kernel n/a

CVE-2015-8452

Matching Score-8

Matching Score-8

CVSS Score-10||HIGH

EPSS-6.69% / 93.20%

7 Day CHG~0.00%

Published-10 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, and CVE-2015-8454.

Vendor-n/a Apple Inc.Google LLC Linux Kernel Organization, Inc Microsoft Corporation Adobe Inc.

Product-linux_kernel mac_os_x windows flash_player iphone_os air_sdk android air air_sdk_\&_compiler n/a

CVE-2015-9035

Matching Score-8

Assigner-Qualcomm, Inc.

Matching Score-8

Assigner-Qualcomm, Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.84% / 53.97%

7 Day CHG~0.00%

Published-18 Aug, 2017 | 18:00

Updated-13 May, 2026 | 00:24

In all Qualcomm products with Android releases from CAF using the Linux kernel, a memory buffer fails to be freed after it is no longer needed potentially resulting in memory exhaustion.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2015-8426

Matching Score-8

Matching Score-8