CVE-2018-4878 A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of list...
HighCVSS 7.8
EPSS 90.3%
CISA KEV
added 2021-11-03 · due 2022-05-03
Ransomware
Exploited in the wild
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Known
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Adobe flash player | < 28.0.0.161 | 28.0.0.161 |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
References
- blog.talosintelligence.com technical-description third-party-advisory
- 102893 broken-link vdb-entry
- 1040318 broken-link vdb-entry
- RHSA-2018:0285 third-party-advisory vendor-advisory
- blog.morphisec.com third-party-advisory
- github.com third-party-advisory
- github.com third-party-advisory
- helpx.adobe.com vendor-advisory
- securingtomorrow.mcafee.com exploit third-party-advisory
- threatpost.com third-party-advisory
- www.darkreading.com press-media-coverage third-party-advisory
- 44412 exploit third-party-advisory vdb-entry
- www.fireeye.com third-party-advisory
- www.trendmicro.com technical-description third-party-advisory
- github.com issue-tracking
- www.cisa.gov government-resource third-party-advisory us-government-resource