CVE-2016-1010: Adobe Flash Player and AIR Integer Overflow Vulnerability
CVE-2016-1010 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2022-05-25
An integer overflow vulnerability in Adobe Flash Player and AIR allows remote attackers to execute arbitrary code via unspecified vectors. The vulnerability is confirmed to have been exploited in the wild and affects multiple platforms including Windows, OS X, and Linux.
Yes. CVE-2016-1010 is known to be exploited in the wild, first recorded on 25 May 2022. Treat it as urgent.
How severe is CVE-2016-1010?
Critical severity, with a CVSS score of 8.8, published 25 May 2022.
Which products and versions are affected?
Adobe Flash Player before 18.0.0.333, 19.x through 21.x before 21.0.0.182; Adobe AIR before 21.0.0.176; Adobe AIR SDK before 21.0.0.176; Adobe AIR SDK & Compiler before 21.0.0.176.
Is there a fix for CVE-2016-1010?
A patch was published on 2016-03-10: Adobe released security bulletin APSB16-08 addressing the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-1010 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2016-1010?
Check whether you run Adobe AIR or Adobe Flash Player. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Affected products
Adobe Flash Player before 18.0.0.333, 19.x through 21.x before 21.0.0.182
Adobe AIR before 21.0.0.176
Adobe AIR SDK before 21.0.0.176
Adobe AIR SDK & Compiler before 21.0.0.176
Timeline
2016-03-10: patched: Adobe released security bulletin APSB16-08 addressing the issue.
2022-05-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.