Known exploited vulnerability
CVE-2018-4878
The short answer
CVE-2018-4878 affects n/a Adobe Flash Player before 28.0.0.161 and is rated high (CVSS 7.8). CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03: attackers are using it, so patch it first.
What it is
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
Weakness: CWE-416.
Severity
7.8 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploited (CISA KEV)
Yes, since Nov 3, 2021
Federal due date May 3, 2022
EPSS, next 30 days
90%
Higher than 100% of scored CVEs
How it can be exploited
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality impact
- High
- Integrity impact
- High
- Availability impact
- High
What CISA says to do
The impacted product is end-of-life and should be disconnected if still in use.
Affected products
Adobe Flash Player before 28.0.0.161. NVD's record lists the exact affected versions.
References
- access.redhat.com/errata/RHSA-2018:0285 Third Party Advisory
- blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign Third Party Advisory
- github.com/InQuest/malware-samples/tree/master/CVE-2018-4878-Adobe-Flash-DRM-UAF-0day Third Party Advisory
- github.com/vysec/CVE-2018-4878 Third Party Advisory
- helpx.adobe.com/security/products/flash-player/apsb18-03.html Vendor Advisory
- securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism/ ExploitThird Party Advisory
- threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742/ Third Party Advisory
- www.darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/1331139 Press/Media CoverageThird Party Advisory
- www.exploit-db.com/exploits/44412/ ExploitThird Party AdvisoryVDB Entry
- www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html Third Party Advisory
- www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hackers-allegedly-exploit-adobe-flash-player-vulnerability-cve-2018-4878-against-south-korean-targets Technical DescriptionThird Party Advisory
- access.redhat.com/errata/RHSA-2018:0285 Third Party Advisory
Questions
Is CVE-2018-4878 being exploited?
Yes. CISA added CVE-2018-4878 to its Known Exploited Vulnerabilities catalog on 2021-11-03, with a federal remediation due date of 2022-05-03. CISA lists it as used in ransomware campaigns.
How do I fix CVE-2018-4878?
CISA's required action: The impacted product is end-of-life and should be disconnected if still in use.
From NVD, CISA KEV, FIRST EPSS and OSV.dev, checked . Status on NVD: Analyzed. The description is NVD's text, quoted as published.
Related
Latest CVEs this week
Critical and High CVEs from the last 7 days, with KEV and EPSS.
Exploited vulnerabilities by vendor
Every vendor in CISA's KEV catalog, with its count.
Adobe exploited vulnerabilities
Everything CISA lists as exploited for Adobe.
Vulnerability watch
A briefing and a fix pull request when an advisory hits your dependencies.
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.