製品・ソフトウェアに関する情報

JVN脆弱性詳細

Adobe Flash Player および Adobe AIR における任意のコードを実行される脆弱性

Title	Adobe Flash Player および Adobe AIR における任意のコードを実行される脆弱性
Summary	Adobe Flash Player および Adobe AIR には、任意のコードを実行される脆弱性が存在します。本脆弱性への攻撃が 2016 年 5 月に観測されています。
Possible impacts	第三者により、任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 12, 2016, midnight
Registration Date	May 16, 2016, 2:50 p.m.
Last Update	May 16, 2016, 2:50 p.m.

CVSS3.0 : 緊急
Score	9.8
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS2.0 : 危険
Score	10
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected System

マイクロソフト

Microsoft Windows 10 for 32-bit Systems

Microsoft Windows 10 for x64-based Systems

Microsoft Windows 10 Version 1511 for 32-bit Systems

Microsoft Windows 10 Version 1511 for x64-based Systems

Microsoft Windows 10 for 32-bit Systems

Microsoft Windows 10 for x64-based Systems

Microsoft Windows 10 Version 1511 for 32-bit Systems

Microsoft Windows 10 Version 1511 for x64-based Systems

Microsoft Windows 8.1 for 32-bit Systems

Microsoft Windows 8.1 for x64-based Systems

Microsoft Windows 8.1 for 32-bit Systems

Microsoft Windows 8.1 for x64-based Systems

Microsoft Windows RT 8.1

Microsoft Windows Server 2012

Microsoft Windows Server 2012 R2

Microsoft Windows Server 2012

Microsoft Windows Server 2012 R2

アドビシステムズ

Adobe AIR デスクトップランタイム 21.0.0.215 未満 (Windows/Macintosh)

Adobe AIR SDK 21.0.0.215 未満 (Windows/Macintosh/Android/iOS)

Adobe AIR SDK & Compiler 21.0.0.215 未満 (Windows/Macintosh/Android/iOS)

Adobe Flash Player 11.2.202.621 未満 (Linux)

Adobe Flash Player 21.0.0.242 未満 (Windows 10/8.1 版の Microsoft Edge/Internet Explorer 11)

Adobe Flash Player 21.0.0.242 未満 (Windows/Macintosh/Linux/ChromeOS 版の Chrome)

Adobe Flash Player デスクトップランタイム 21.0.0.242 未満 (Windows/Macintosh)

Adobe Flash Player 継続サポートリリース 18.0.0.352 未満 (Windows/Macintosh)

Adobe Flash Player 11.2.202.621 未満 (Linux)

Adobe Flash Player 21.0.0.242 未満 (Windows 10/8.1 版の Microsoft Edge/Internet Explorer 11)

Adobe Flash Player 21.0.0.242 未満 (Windows/Macintosh/Linux/ChromeOS 版の Chrome)

Adobe Flash Player デスクトップランタイム 21.0.0.242 未満 (Windows/Macintosh)

Adobe Flash Player 継続サポートリリース 18.0.0.352 未満 (Windows/Macintosh)

Google

Google Chrome

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2016-4117	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4117
2	CVE-2016-4117	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4117
National Vulnerability Database (NVD)
3	CVE-2016-4117	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4117
4	CVE-2016-4117	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4117

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo
2	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Adobe Security Bulletin
1	APSA16-02	http://helpx.adobe.com/security/products/flash-player/apsa16-02.html
2	APSA16-02	http://helpx.adobe.com/security/products/flash-player/apsa16-02.html
3	APSB16-15	http://helpx.adobe.com/security/products/flash-player/apsb16-15.html
4	APSB16-15	http://helpx.adobe.com/security/products/flash-player/apsb16-15.html
Adobe セキュリティ情報
5	APSA16-02	http://helpx.adobe.com/jp/security/products/flash-player/apsa16-02.html
6	APSA16-02	http://helpx.adobe.com/jp/security/products/flash-player/apsa16-02.html
7	APSB16-15	http://helpx.adobe.com/jp/security/products/flash-player/apsb16-15.html
8	APSB16-15	http://helpx.adobe.com/jp/security/products/flash-player/apsb16-15.html
Google
9	Chrome Releases	http://googlechromereleases.blogspot.jp/
10	Chrome Releases	http://googlechromereleases.blogspot.jp/
11	Google Chrome	https://www.google.com/intl/ja/chrome/browser/features.html
12	Google Chrome	https://www.google.com/intl/ja/chrome/browser/features.html
13	Google Chrome を更新する	https://support.google.com/chrome/answer/95414?hl=ja
14	Google Chrome を更新する	https://support.google.com/chrome/answer/95414?hl=ja
Microsoft Security Advisory
15	MS16-064	https://technet.microsoft.com/en-us/library/security/ms16-064.aspx
16	MS16-064	https://technet.microsoft.com/en-us/library/security/ms16-064.aspx
マイクロソフトセキュリティアドバイザリ
17	MS16-064	https://technet.microsoft.com/ja-jp/library/security/ms16-064.aspx
18	MS16-064	https://technet.microsoft.com/ja-jp/library/security/ms16-064.aspx

その他

No	Name	URL
IPA 重要なセキュリティ情報
1	更新：Adobe Flash Player の脆弱性対策について(APSA16-02)(APSB16-15)(CVE-2016-4117等)	https://www.ipa.go.jp/security/ciadr/vul/20160511-adobeflashplayer.html
2	更新：Adobe Flash Player の脆弱性対策について(APSA16-02)(APSB16-15)(CVE-2016-4117等)	https://www.ipa.go.jp/security/ciadr/vul/20160511-adobeflashplayer.html
JPCERT 注意喚起
3	JPCERT-AT-2016-0024	https://www.jpcert.or.jp/at/2016/at160024.html
4	JPCERT-AT-2016-0024	https://www.jpcert.or.jp/at/2016/at160024.html
警察庁 @police
5	アドビシステムズ社の Adobe Flash Player のセキュリティ修正プログラムについて(2016年05月13日)	http://www.npa.go.jp/cyberpolice/topics/?seq=18389
6	アドビシステムズ社の Adobe Flash Player のセキュリティ修正プログラムについて(2016年05月13日)	http://www.npa.go.jp/cyberpolice/topics/?seq=18389

Change Log

No	Changed Details	Date of change
0	[2016年05月16日] 掲載	Feb. 17, 2018, 10:37 a.m.
0	[2016年05月16日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2016-4117

Summary	Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.
Publication Date	May 11, 2016, 10:59 a.m.
Registration Date	Jan. 26, 2021, 2:11 p.m.
Last Update	Nov. 21, 2024, 11:51 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:adobe:flash_player::::::::			21.0.0.226

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:opensuse:evergreen:11.4:::::::*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1::::::
cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1::::::
cpe:2.3:o:opensuse:opensuse:13.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:12:-::::::
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-::::::

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00044.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00045.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00046.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00047.html	Mailing List Third Party Advisory
9	http://rhn.redhat.com/errata/RHSA-2016-1079.html	Third Party Advisory
10	http://rhn.redhat.com/errata/RHSA-2016-1079.html	Third Party Advisory
11	http://www.securityfocus.com/bid/90505	Broken Link Third Party Advisory VDB Entry
12	http://www.securityfocus.com/bid/90505	Broken Link Third Party Advisory VDB Entry
13	http://www.securitytracker.com/id/1035826	Broken Link Third Party Advisory VDB Entry
14	http://www.securitytracker.com/id/1035826	Broken Link Third Party Advisory VDB Entry
15	https://helpx.adobe.com/security/products/flash-player/apsa16-02.html	Broken Link Vendor Advisory
16	https://helpx.adobe.com/security/products/flash-player/apsa16-02.html	Broken Link Vendor Advisory
17	https://helpx.adobe.com/security/products/flash-player/apsb16-15.html	Broken Link
18	https://helpx.adobe.com/security/products/flash-player/apsb16-15.html	Broken Link
19	https://security.gentoo.org/glsa/201606-08	Third Party Advisory
20	https://security.gentoo.org/glsa/201606-08	Third Party Advisory
21	https://www.exploit-db.com/exploits/46339/	Exploit Third Party Advisory VDB Entry
22	https://www.exploit-db.com/exploits/46339/	Exploit Third Party Advisory VDB Entry

Common Vulnerabilities List

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_from_rhui:5.0:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:opensuse:evergreen:11.4:::::::*
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:sp1::::::
cpe:2.3:o:suse:linux_enterprise_desktop:12:sp1::::::
cpe:2.3:o:opensuse:opensuse:13.1:::::::*
cpe:2.3:o:opensuse:opensuse:13.2:::::::*
cpe:2.3:o:suse:linux_enterprise_desktop:12:-::::::
cpe:2.3:o:suse:linux_enterprise_workstation_extension:12:-::::::