A critical vulnerability (CVE-2016-1019) exists in Adobe Flash Player 220.127.116.11 and earlier versions for Windows, Macintosh, Linux, and Chrome OS. Successful exploitation could cause a crash and potentially allow an attacker to take control of the affected system.
Updates for Adobe Flash Player were released, further details are in the APSB16-10 bulletin.
Adobe Security Bulletin APSB16-10 for Adobe Flash Player describes multiple flaws that can possibly lead to code execution when Flash Player is used to play a specially crafted SWF file.
Quoting from the APSB16-10:
These updates harden a mitigation against JIT spraying attacks that could be used to bypass memory layout randomization mitigations (CVE-2016-1006).
These updates resolve type confusion vulnerabilities that could lead to code execution (CVE-2016-1015, CVE-2016-1019).
These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2016-1011, CVE-2016-1013, CVE-2016-1016, CVE-2016-1017, CVE-2016-1031).
These updates resolve memory corruption vulnerabilities that could lead to code execution (CVE-2016-1012, CVE-2016-1020, CVE-2016-1021, CVE-2016-1022, CVE-2016-1023, CVE-2016-1024, CVE-2016-1025, CVE-2016-1026, CVE-2016-1027, CVE-2016-1028, CVE-2016-1029, CVE-2016-1032, CVE-2016-1033).
These updates resolve a stack overflow vulnerability that could lead to code execution (CVE-2016-1018).
These updates resolve a security bypass vulnerability (CVE-2016-1030).
These updates resolve a vulnerability in the directory search path used to find resources that could lead to code execution (CVE-2016-1014).
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6 Supplementary
Red Hat Enterprise Linux 5 Supplementary
Via RHSA-2016:0610 https://rhn.redhat.com/errata/RHSA-2016-0610.html