vulnwire
7.8high

CVE-2018-4878KEV · ransomwarein critical feed3 exploits

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
90.3%
percentile 100%
Public exploits
3
Exploit-DB

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

Known exploited (CISA KEV)

Added
5 y ago
Due date
2022-05-03 (4 y ago)
Ransomware use
Known to be used in ransomware campaigns
Required action
The impacted product is end-of-life and should be disconnected if still in use.
Vendor / product
Adobe / Flash Player
CISA name
Adobe Flash Player Use-After-Free Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
total
Assessed
11 mo ago

Exploit prediction (EPSS)

90.28% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.

Exploits and detections

  • EDB-44745 Flash ActiveX 28.0.0.137 - Code Execution (2) · local · 2016-02-13
  • EDB-44744 Flash ActiveX 28.0.0.137 - Code Execution (1) · local · 2016-02-16
  • EDB-44412 Adobe Flash < 28.0.0.161 - Use-After-Free · remote · 2018-04-06

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • n/a Adobe Flash Player before 28.0.0.161

Classification

Weakness

References

  • blog.talosintelligence.com /2018/02/group-123-goes-wild.html · x_refsource_MISC, x_transferred
  • threatpost.com /adobe-flash-player-zero-day-spotted-in-the-wild/129742/ · x_refsource_MISC, x_transferred
  • helpx.adobe.com /security/products/flash-player/apsb18-03.html · x_refsource_MISC, x_transferred
  • access.redhat.com /errata/RHSA-2018:0285 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securitytracker.com /id/1040318 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • securityfocus.com /bid/102893 · vdb-entry, x_refsource_BID, x_transferred
  • fireeye.com /blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html · x_refsource_MISC, x_transferred
  • blog.morphisec.com /flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign · x_refsource_MISC, x_transferred
  • darkreading.com /threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/13 · x_refsource_MISC, x_transferred
  • github.com /InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day · x_refsource_MISC, x_transferred
  • trendmicro.com /vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hackers-allegedly-exploi · x_refsource_MISC, x_transferred
  • github.com /vysec/CVE-2018-4878 · x_refsource_MISC, x_transferred
  • securingtomorrow.mcafee.com /mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/ · x_refsource_MISC, x_transferred
  • exploit-db.com /exploits/44412/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4878 · government-resource
  • github.com /cisagov/vulnrichment/issues/196 · issue-tracking

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.