Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 588738 (APSB16-25, CVE-2016-4172, CVE-2016-4173, CVE-2016-4174, CVE-2016-4175, CVE-2016-4176, CVE-2016-4177, CVE-2016-4178, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4222, CVE-2016-4223, CVE-2016-4224, CVE-2016-4225, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4232, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246, CVE-2016-4247, CVE-2016-4248, CVE-2016-4249)

Summary: <www-plugins/adobe-flash-11.2.202.632 : Multiple vulnerabilities (CVE-2016-{4217,4218,4219,4220,4221,4222,4223,4224,4225,4226,4227,4228,4229,4230,4231,4232,4233,4234,4235,4236,4237,4238,4239,4240,4241,4242,4243,4244,4245,4246,4247,4248,4249})
Product: Gentoo Security Reporter: Kristian Fiskerstrand (RETIRED) <k_f>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: jer
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://helpx.adobe.com/security/products/flash-player/apsb16-25.html
Whiteboard: A2 [glsa cve]
Package list:
Runtime testing required: ---

Description Kristian Fiskerstrand (RETIRED) gentoo-dev 2016-07-13 07:52:39 UTC 
Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS.  These updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.  

Product 	Affected Versions 	Platform
Adobe Flash Player for Linux 	11.2.202.626 and earlier 	Linux


    These updates resolve a race condition vulnerability that could lead to information disclosure (CVE-2016-4247).

    These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-4223, CVE-2016-4224, CVE-2016-4225).

    These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-4173, CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4248).

    These updates resolve a heap buffer overflow vulnerability that could lead to code execution (CVE-2016-4249).

    These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-4172, CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246).

    These updates resolve a memory leak vulnerability (CVE-2016-4232).

    These updates resolve stack corruption vulnerabilities that could lead to code execution (CVE-2016-4176, CVE-2016-4177).

    These updates resolve a security bypass vulnerability that could lead to information disclosure (CVE-2016-4178)

Acknowledgments

    Yuki Chen of Qihoo 360 Vulcan Team working with the Chromium Vulnerability Rewards Program (CVE-2016-4249)

    Nicolas Joly of Microsoft Vulnerability Research (CVE-2016-4173)

    Wen Guanxing from Pangu LAB (CVE-2016-4188, CVE-2016-4248)

    Jaehun Jeong(@n3sk) of WINS WSEC Analysis Team working with Trend Micro's Zero Day Initiative (CVE-2016-4222)

    Kai Kang (a.k.a 4B5F5F4B) working with Trend Micro's Zero Day Initiative (CVE-2016-4174)

    willJ of Tencent PC Manager (CVE-2016-4172)

    Natalie Silvanovich of Google Project Zero (CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229, CVE-2016-4230, CVE-2016-4231, CVE-2016-4232)

    Garandou Sara working with Trend Micro's Zero Day Initiative (CVE-2016-4223)

    Sébastien Morin of COSIG (CVE-2016-4175, CVE-2016-4179)

    Kurutsu Karen working with Trend Micro's Zero Day Initiative (CVE-2016-4225)

    Soroush Dalili from NCC Group (CVE-2016-4178)

    Yuki Chen of Qihoo 360 Vulcan Team (CVE-2016-4180, CVE-2016-4181, CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245, CVE-2016-4246)

    Yuki Chen of Qihoo 360 Vulcan Team and Wen Guanxing from Pangu LAB (CVE-2016-4182)

    Junfeng Yang and Genwei Jiang of FireEye and Yuki Chen of Qihoo 360 Vulcan Team (CVE-2016-4185)

    Ohara Rinne working with Trend Micro's Zero Day Initiative (CVE-2016-4224)

    Francis Provencher of COSIG (CVE-2016-4176, CVE-2016-4177)

    Jie Zeng of Tencent Zhanlu Lab (CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218, CVE-2016-4219, CVE-2016-4220, CVE-2016-4221)

    Stefan Kanthak (CVE-2016-4247)
Comment 1 Jeroen Roovers (RETIRED) gentoo-dev 2016-07-13 13:54:25 UTC 
Oh they forgot to list that under https://helpx.adobe.com/security/products/flash-player.html#version11 ?
Comment 2 Jeroen Roovers (RETIRED) gentoo-dev 2016-07-13 13:56:41 UTC 
Arch teams, please test and mark stable:
=www-plugins/adobe-flash-11.2.202.632
Targeted stable KEYWORDS : amd64 x86
Comment 3 Agostino Sarubbo gentoo-dev 2016-07-13 16:10:26 UTC 
amd64 stable
Comment 4 Agostino Sarubbo gentoo-dev 2016-07-13 16:10:53 UTC 
x86 stable.

Maintainer(s), please cleanup.
Security, please add it to the existing request, or file a new one.
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2016-07-13 18:13:29 UTC 
CVE-2016-4233 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4233):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4234, CVE-2016-4235,
  CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4232 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4232):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  obtain sensitive information from process memory via unspecified vectors.

CVE-2016-4231 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4231):
  Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and
  19.x through 22.x before 22.0.0.209 on Windows and OS X and before
  11.2.202.632 on Linux allows attackers to execute arbitrary code via
  unspecified vectors, a different vulnerability than CVE-2016-4173,
  CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228,
  CVE-2016-4229, CVE-2016-4230, and CVE-2016-4248.

CVE-2016-4230 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4230):
  Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and
  19.x through 22.x before 22.0.0.209 on Windows and OS X and before
  11.2.202.632 on Linux allows attackers to execute arbitrary code via
  unspecified vectors, a different vulnerability than CVE-2016-4173,
  CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228,
  CVE-2016-4229, CVE-2016-4231, and CVE-2016-4248.

CVE-2016-4229 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4229):
  Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and
  19.x through 22.x before 22.0.0.209 on Windows and OS X and before
  11.2.202.632 on Linux allows attackers to execute arbitrary code via
  unspecified vectors, a different vulnerability than CVE-2016-4173,
  CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228,
  CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

CVE-2016-4228 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4228):
  Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and
  19.x through 22.x before 22.0.0.209 on Windows and OS X and before
  11.2.202.632 on Linux allows attackers to execute arbitrary code via
  unspecified vectors, a different vulnerability than CVE-2016-4173,
  CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4229,
  CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

CVE-2016-4227 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4227):
  Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and
  19.x through 22.x before 22.0.0.209 on Windows and OS X and before
  11.2.202.632 on Linux allows attackers to execute arbitrary code via
  unspecified vectors, a different vulnerability than CVE-2016-4173,
  CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4228, CVE-2016-4229,
  CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

CVE-2016-4226 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4226):
  Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and
  19.x through 22.x before 22.0.0.209 on Windows and OS X and before
  11.2.202.632 on Linux allows attackers to execute arbitrary code via
  unspecified vectors, a different vulnerability than CVE-2016-4173,
  CVE-2016-4174, CVE-2016-4222, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229,
  CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

CVE-2016-4225 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4225):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code by leveraging an unspecified "type confusion," a
  different vulnerability than CVE-2016-4223 and CVE-2016-4224.

CVE-2016-4224 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4224):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code by leveraging an unspecified "type confusion," a
  different vulnerability than CVE-2016-4223 and CVE-2016-4225.

CVE-2016-4223 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4223):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code by leveraging an unspecified "type confusion," a
  different vulnerability than CVE-2016-4224 and CVE-2016-4225.

CVE-2016-4222 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4222):
  Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and
  19.x through 22.x before 22.0.0.209 on Windows and OS X and before
  11.2.202.632 on Linux allows attackers to execute arbitrary code via
  unspecified vectors, a different vulnerability than CVE-2016-4173,
  CVE-2016-4174, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228, CVE-2016-4229,
  CVE-2016-4230, CVE-2016-4231, and CVE-2016-4248.

CVE-2016-4221 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4221):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235,
  CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4220 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4220):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235,
  CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4219 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4219):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235,
  CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4218 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4218):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4219,
  CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235,
  CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4217 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4217):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4218, CVE-2016-4219,
  CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234, CVE-2016-4235,
  CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.
Comment 6 GLSAMaker/CVETool Bot gentoo-dev 2016-07-13 18:14:07 UTC 
CVE-2016-4249 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4249):
  Heap-based buffer overflow in Adobe Flash Player before 18.0.0.366 and 19.x
  through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632
  on Linux allows attackers to execute arbitrary code via unspecified vectors.

CVE-2016-4248 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4248):
  Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and
  19.x through 22.x before 22.0.0.209 on Windows and OS X and before
  11.2.202.632 on Linux allows attackers to execute arbitrary code via
  unspecified vectors, a different vulnerability than CVE-2016-4173,
  CVE-2016-4174, CVE-2016-4222, CVE-2016-4226, CVE-2016-4227, CVE-2016-4228,
  CVE-2016-4229, CVE-2016-4230, and CVE-2016-4231.

CVE-2016-4247 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4247):
  Race condition in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x
  before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux
  allows attackers to obtain sensitive information via unspecified vectors.

CVE-2016-4246 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4246):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239,
  CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244,
  and CVE-2016-4245.

CVE-2016-4245 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4245):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239,
  CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244,
  and CVE-2016-4246.

CVE-2016-4244 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4244):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239,
  CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4243 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4243):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239,
  CVE-2016-4240, CVE-2016-4241, CVE-2016-4242, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4242 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4242):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239,
  CVE-2016-4240, CVE-2016-4241, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4241 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4241):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239,
  CVE-2016-4240, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4240 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4240):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4239 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4239):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4238 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4238):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4237, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4237 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4237):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4236, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4236 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4236):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4235, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4235 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4235):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4234,
  CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.

CVE-2016-4234 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-4234):
  Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209
  on Windows and OS X and before 11.2.202.632 on Linux allows attackers to
  execute arbitrary code or cause a denial of service (memory corruption) via
  unspecified vectors, a different vulnerability than CVE-2016-4172,
  CVE-2016-4175, CVE-2016-4179, CVE-2016-4180, CVE-2016-4181, CVE-2016-4182,
  CVE-2016-4183, CVE-2016-4184, CVE-2016-4185, CVE-2016-4186, CVE-2016-4187,
  CVE-2016-4188, CVE-2016-4189, CVE-2016-4190, CVE-2016-4217, CVE-2016-4218,
  CVE-2016-4219, CVE-2016-4220, CVE-2016-4221, CVE-2016-4233, CVE-2016-4235,
  CVE-2016-4236, CVE-2016-4237, CVE-2016-4238, CVE-2016-4239, CVE-2016-4240,
  CVE-2016-4241, CVE-2016-4242, CVE-2016-4243, CVE-2016-4244, CVE-2016-4245,
  and CVE-2016-4246.
Comment 7 Aaron Bauman (RETIRED) gentoo-dev 2016-07-13 18:19:32 UTC 
New GLSA request opened.
Comment 8 GLSAMaker/CVETool Bot gentoo-dev 2016-07-13 18:43:54 UTC 
This issue was resolved and addressed in
 GLSA 201607-03 at https://security.gentoo.org/glsa/201607-03
by GLSA coordinator Aaron Bauman (b-man).