CVE-2018-4878

CVSS 7.8 HIGHEPSS 89.6%● KEVCWE-416

In short

Adobe Flash Player had a memory flaw where it tried to use data that was already deleted, allowing attackers to run malicious code on your computer. This vulnerability was actively exploited by hackers in early 2018.

Technical detail

A use-after-free vulnerability in Adobe Flash Player's Primetime SDK media player component allows remote code execution through a dangling pointer in listener object handling. The attack vector is typically through malicious media content, and successful exploitation requires the victim to interact with crafted content in a vulnerable Flash context.

Summary generated and translated by AI from the official description.

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

n/a · Adobe Flash Player before 28.0.0.161

public PoCs found — 15

githubgithub.com/vysecurity/CVE-2018-4878★ 86 githubgithub.com/mdsecactivebreach/CVE-2018-4878★ 23 githubgithub.com/SyFi/CVE-2018-4878★ 7 githubgithub.com/B0fH/CVE-2018-4878★ 2 githubgithub.com/ydl555/CVE-2018-4878-★ 1 githubgithub.com/HuanWoWeiLan/SoftwareSystemSecurity-2019★ 1 githubgithub.com/KathodeN/CVE-2018-4878★ 0 githubgithub.com/demonsec666/CVE-2018-4878★ 0 githubgithub.com/lvyoshino/CVE-2018-4878★ 0 githubgithub.com/ydl555/CVE-2018-4878★ 0 githubgithub.com/Yable/CVE-2018-4878★ 0 exploitdbwww.exploit-db.com/exploits/44745unverified exploitdbwww.exploit-db.com/exploits/44412unverified exploitdbwww.exploit-db.com/exploits/44744unverified cve_referencewww.exploit-db.com/exploits/44412/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html https://access.redhat.com/errata/RHSA-2018:0285 https://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign https://github.com/cisagov/vulnrichment/issues/196 https://github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day https://github.com/vysec/CVE-2018-4878 https://helpx.adobe.com/security/products/flash-player/apsb18-03.html https://securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/https://threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-4878 https://www.darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/1331139 https://www.exploit-db.com/exploits/44412/