CVE-2018-15982highunder attackransomwareCWE-416

CVE-2018-15982

Published · Updated

Follow this CVE+ Monitor Flash Player

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

98Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.8epss 90%
from disclosure to weaponsame day
Published on NVDJan 18
1st PoCDec 5
CISA KEV+1124d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
3 products
Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6)
fix ↗
Action required by CISAfederal deadline: 2022-08-15

The impacted product is end-of-life and should be disconnected if still in use.

In short

Flash Player has a flaw where it tries to use memory that has already been freed, potentially allowing an attacker to run malicious code on your computer.

Technical detail

Use-after-free vulnerability in Flash Player (versions ≤31.0.0.153 and ≤31.0.0.108) allows an attacker to execute arbitrary code by triggering access to previously deallocated memory, typically through crafted Flash content.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.