KLA11208 Multiple vulnerabilities in Adobe Flash Player

Multiple serious vulnerabilities have been found in Adobe Flash Player. Malicious users can exploit these vulnerabilities to execute arbitrary code.

Below is a complete list of vulnerabilities:

1. An use-after-free vulnerability can be exploited remotely to execute arbitrary code;
2. A type-confusion vulnerability can be exploited remotely to execute arbitrary code.

Technical details

To update Adobe Flash Player ActiveX (detected as Flash.ocx) on Windows 8 and higher, install latest updates from Control Panel

Original advisories

APSB18-05

Related products

Adobe-Flash-Player-ActiveX

Adobe-Flash-Player-NPAPI

Adobe-Flash-Player-PPAPI

CVE list

CVE-2018-4920 critical

CVE-2018-4919 critical

Solution

Update to the latest version

Download Adobe Flash Player

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Affected Products

• Adobe Flash Player earlier than 29.0.0.113