[ CVE-2018-15982 · Published 18 Jan 2019 ]
Adobe Flash Player Use-After-Free Vulnerability
Exploited · CISA KEV CVSS 7.8
EPSS 90%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-02-15
- Known to be used in ransomware campaigns
- EPSS: 90% chance of exploitation in the next 30 days (higher than 100% of CVEs)
[ Description ]Official description
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CISA: Adobe Flash Player com.adobe.tvsdk.mediacore.metadata Use After Free Vulnerability
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 15 Aug 2022): The impacted product is end-of-life and should be disconnected if still in use.
- Patch on helpx.adobe.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- www.securityfocus.com/bid/106116Broken LinkThird Party AdvisoryVDB Entry
- access.redhat.com/errata/RHSA-2018:3795Third Party Advisory
- helpx.adobe.com/security/products/flash-player/apsb18-42.htmlPatchVendor Advisory
- www.exploit-db.com/exploits/46051ExploitThird Party AdvisoryVDB Entry
- github.com/cisagov/vulnrichment/issues/195Issue Tracking
- www.cisa.gov/known-exploited-vulnerabilities-catalogThird Party AdvisoryUS Government Resource