Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveAdobeCVE-2018-4878
HistoryFeb 06, 2018 - 9:29 p.m.

CVE-2018-4878

2018-02-0621:29:00
CWE-416
adobe
web.nvd.nist.gov
1308
In Wild
1
adobe flash player
cve-2018-4878
primetime sdk
media player handling
security vulnerability
code execution
nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.973

Percentile

99.9%

JSON

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

Affected configurations

Nvd
Vulners
Node
applemacosMatch-
OR
linuxlinux_kernelMatch-
OR
microsoftwindowsMatch-
AND
adobeflash_playerRange<28.0.0.161
Node
redhatenterprise_linux_desktopMatch6.0
OR
redhatenterprise_linux_serverMatch6.0
OR
redhatenterprise_linux_workstationMatch6.0
Node
microsoftwindows_10
OR
microsoftwindows_8.1
AND
adobeflash_playerRange<28.0.0.161edge
OR
adobeflash_playerRange<28.0.0.161internet_explorer_11
Node
applemacosMatch-
OR
googlechrome_osMatch-
OR
linuxlinux_kernelMatch-
OR
microsoftwindowsMatch-
AND
adobeflash_playerRange<28.0.0.161chrome
VendorProductVersionCPE
applemacos-cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
adobeflash_player*cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*
redhatenterprise_linux_desktop6.0cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhatenterprise_linux_server6.0cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhatenterprise_linux_workstation6.0cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
microsoftwindows_10*cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*
microsoftwindows_8.1*cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*
adobeflash_player*cpe:2.3:a:adobe:flash_player:*:*:*:*:*:edge:*:*
Rows per page:
1-10 of 131

CNA Affected

[
  {
    "product": "Adobe Flash Player before 28.0.0.161",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Adobe Flash Player before 28.0.0.161"
      }
    ]
  }
]

References

Social References

More

Related

threatpost 4
attackerkb 1
ubuntucve 1
nvd 1
krebs 1
malwarebytes 18
symantec 1
exploitpack 3
zdt 3
cvelist 1
exploitdb 3
talosblog 1
fireeye 7
trendmicroblog 3
prion 1
seebug 1
myhack58 3
adobe 2
cisa_kev 1
packetstorm 1
checkpoint_advisories 1
thn 1
nessus 6
openvas 8
redhatcve 2
mageia 1
freebsd 1
redhat 1
mscve 1
kaspersky 1
securelist 3
qualysblog 3
gentoo 1
ics 1
threatpost
threatpost
Massive Spam Campaign Targets Unpatched Systems
2018-02-27 17:55:35
Adobe Patches Zero-Day Vulnerability in Flash Player
2018-12-05 15:18:09
Adobe Flash Player Zero-Day Spotted in the Wild
2018-02-01 15:40:55
attackerkb
attackerkb
CVE-2018-4878
2018-02-06 00:00:00
ubuntucve
ubuntucve
CVE-2018-4878
2018-02-06 00:00:00
nvd
nvd
CVE-2018-4878
2018-02-06 21:29:00
krebs
krebs
Attackers Exploiting Unpatched Flaw in Flash
2018-02-02 14:21:06
malwarebytes
malwarebytes
New Flash Player zero-day comes inside Office document
2018-02-05 20:55:16
Week in security (February 26 – March 4)
2018-03-05 17:00:00
Hermes ransomware distributed to South Koreans via recent Flash zero-day
2018-03-14 17:59:32
symantec
symantec
Adobe Flash Player CVE-2018-4878 Use After Free Remote Code Execution Vulnerability
2018-02-01 00:00:00
exploitpack
exploitpack
Adobe Flash 28.0.0.161 - Use-After-Free
2018-04-06 00:00:00
Flash ActiveX 28.0.0.137 - Code Execution (1)
2016-02-16 00:00:00
Flash ActiveX 28.0.0.137 - Code Execution (2)
2016-02-13 00:00:00
zdt
zdt
Adobe Flash 28.0.0.137 Remote Code Execution Exploit
2018-04-04 00:00:00
Flash ActiveX 28.0.0.137 - Code Execution Exploit (2)
2018-05-24 00:00:00
Flash ActiveX 28.0.0.137 - Code Execution Exploit (1)
2018-05-24 00:00:00
cvelist
cvelist
CVE-2018-4878
2018-02-06 20:00:00
exploitdb
exploitdb
Flash ActiveX 28.0.0.137 - Code Execution (1)
2016-02-16 00:00:00
Adobe Flash &lt; 28.0.0.161 - Use-After-Free
2018-04-06 00:00:00
Flash ActiveX 28.0.0.137 - Code Execution (2)
2016-02-13 00:00:00
talosblog
talosblog
Flash 0-Day In The Wild: Group 123 At The Controls
2018-02-02 08:27:00
fireeye
fireeye
Attacks Leveraging Adobe Zero-Day (CVE-2018-4878) – Threat Attribution, Attack Scenario and Recommendations
2018-02-02 21:15:00
Attacks Leveraging Adobe Zero-Day (CVE-2018-4878) – Threat Attribution, Attack Scenario and Recommendations
2018-02-03 02:15:00
APT37 (Reaper): The Overlooked North Korean Actor
2018-02-20 08:30:00
trendmicroblog
trendmicroblog
This Week in Security News: Trends and Tea Parties
2018-03-02 14:35:07
This Week in Security News: Botnets and Breaches
2018-02-09 14:00:56
TippingPoint Threat Intelligence and Zero-Day Coverage – Week of February 5, 2018
2018-02-09 16:55:38
prion
prion
Design/Logic Flaw
2018-02-06 21:29:00
seebug
seebug
Adobe Flash Player Use After Free Remote Code Execution Vulnerability(CVE-2018-4878)
2018-02-23 00:00:00
myhack58
myhack58
CVE-2018-4878 case: for a Hong Kong Telecommunications Company website is intrusion investigations-vulnerability and early warning-the black bar safety net
2018-04-10 00:00:00
To see the Hidden Bee how to use a new vulnerability propagation-vulnerability warning-the black bar safety net
2018-08-07 00:00:00
The macro perspective of the office vulnerability, 2010-2018-a vulnerability warning-the black bar safety net
2019-06-13 00:00:00
adobe
adobe
APSA18-01 Security Advisory for Adobe Flash Player
2018-02-01 00:00:00
APSB18-03 Security updates available for Adobe Flash Player
2018-02-06 00:00:00
cisa_kev
cisa_kev
Adobe Flash Player Use-After-Free Vulnerability
2021-11-03 00:00:00
packetstorm
packetstorm
Adobe Flash 28.0.0.137 Remote Code Execution
2018-04-04 00:00:00
checkpoint_advisories
checkpoint_advisories
Adobe Flash Player Use After Free (APSB18-03: CVE-2018-4878)
2018-02-04 00:00:00
thn
thn
(Unpatched) Adobe Flash Player Zero-Day Exploit Spotted in the Wild
2018-02-01 19:10:00
nessus
nessus
Adobe Flash Player <= 28.0.0.137 Use-after-free Remote Code Execution (APSA18-01) (APSB18-03)
2018-02-05 00:00:00
KB4074595: Security update for Adobe Flash Player (February 2018)
2018-02-07 00:00:00
RHEL 6 : flash-plugin (RHSA-2018:0285)
2018-02-08 00:00:00
openvas
openvas
Adobe Flash Player Within Google Chrome Multiple RCE Vulnerabilities (APSA18-01) - Windows
2018-02-02 00:00:00
Adobe Flash Player Multiple Remote Code Execution Vulnerabilities - Windows
2018-02-02 00:00:00
Adobe Flash Player Within Google Chrome Multiple RCE Vulnerabilities - Linux
2018-02-02 00:00:00
redhatcve
redhatcve
CVE-2018-4878
2018-02-05 11:19:42
CVE-2018-4877
2018-02-06 20:19:59
mageia
mageia
Updated flash-player-plugin packages fix security vulnerability
2018-02-07 16:50:37
freebsd
freebsd
Flash Player -- multiple vulnerabilities
2018-01-31 00:00:00
redhat
redhat
(RHSA-2018:0285) Critical: flash-plugin security update
2018-02-07 17:47:53
mscve
mscve
February 2018 Adobe Flash Security Update
2018-02-06 08:00:00
kaspersky
kaspersky
KLA11191 Multiple use-after-free vulnerabilities in Adobe Flash Player
2018-02-01 00:00:00
securelist
securelist
APT Trends Report Q2 2018
2018-07-10 10:00:22
APT Trends report Q1 2018
2018-04-12 10:00:17
IT threat evolution Q1 2018. Statistics
2018-05-14 10:00:30
qualysblog
qualysblog
Intel Makes Spectre Patch Progress, while Adobe Grapples with Latest Flash Bug
2018-02-09 15:20:40
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
2019-12-27 18:01:22
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00
gentoo
gentoo
Adobe Flash Player: Multiple vulnerabilities
2018-03-19 00:00:00
ics
ics
Top 10 Routinely Exploited Vulnerabilities
2020-05-12 12:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.973

Percentile

99.9%

JSON
Related for CVE-2018-4878
threatpost4attackerkb1ubuntucve1nvd1krebs1malwarebytes18symantec1exploitpack3zdt3cvelist1exploitdb3talosblog1fireeye7trendmicroblog3prion1seebug1myhack583adobe2cisa_kev1packetstorm1checkpoint_advisories1thn1nessus6openvas8redhatcve2mageia1freebsd1redhat1mscve1kaspersky1securelist3qualysblog3gentoo1ics1