Trusted Design

Killing a Zero-Day in the Egg: Adobe CVE-2016-1019

概要

On April 2, 2016, Proofpoint researchers discovered that the Magnitude exploit kit (EK) [1] was successfully exploiting Adobe Flash version 20.0.0.306. Because the Magnitude EK in question did not direct any exploits to Flash 21.0.0.182, we initially suspected that the exploit was for CVE-2016-1001 as in Angler [2], the combination exploit "CVE-2016-0998/CVE-2016-0984" [3], or CVE-2016-1010. In the course of our investigation, we shared our findings with fellow researchers in the security community in order to accelerate identification of the exploit. A colleague at FireEye determined [4] that the exploited vulnerability was unknown. Adobe was promptly notified of the issue, and they verified that although a mitigation integrated in 21.0.0.182 appeared to cause the exploit to fail, it was a previously unreported vulnerability and assigned it CVE-2016-1019 - See more at: https://www.proofpoint.com/us/threat-insight/post/killing-zero-day-in-the-egg#sthash.t5Hu0reG.dpuf

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Angler, Nuclear Exploit Kits Integrate Pawn Storm Flash Exploit (score: 0.78)
• Security Advisory for Adobe Flash Player (score: 0.77)
• Latest Flash Exploit Used in Pawn Storm (score: 0.76)
• CVE-2015-5122 Exploited in Strategic Web Compromise (score: 0.74)
• Locky Ransomware Spreads via Flash and Windows Kernel Exploits (score: 0.73)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る