Microsoft Targeted by 8 of 10 Top Vulnerabilities in 2018
60
CVE-2018-4878
KEV ransomware PoC ×2massUse-After-Free RCE in Adobe Flash Player before 28.0.0.161
CISA: Adobe Flash Player Use-After-Free Vulnerability
CVSS 3.1
7.8 high
EPSS
90%p100
Published
()
KEV added
AI analysis
CVE-2018-4878 is a use-after-free (CWE-416) in Adobe Flash Player before 28.0.0.161, caused by a dangling pointer in the Primetime SDK's media-player handling of listener objects. An attacker triggers it by persuading a user to open attacker-controlled Flash content — typically a malicious SWF delivered via email, Office documents, or malvertising/exploit kits — because the CVSS vector (AV:L, UI:R) requires local user interaction. Successful exploitation yields arbitrary code execution with the privileges of the user running Flash. Anyone running a vulnerable Flash Player was exposed, including Red Hat Enterprise Linux Desktop/Server/Workstation users running Red Hat's packaged Flash plugin. The flaw was exploited as a zero-day in January–February 2018 (documented by McAfee and distributed alongside the Fallout exploit kit), and it remains in CISA's KEV with known ransomware use.
What to do: Upgrade Adobe Flash Player to 28.0.0.161 or later, including Red Hat's flash-plugin package on RHEL Desktop/Server/Workstation. Because Flash is now end-of-life, CISA's required KEV action is to remove or disconnect Flash entirely where still in use — audit browsers, Office configurations, and legacy RHEL hosts for residual Flash installs, and block SWF content delivered via email and the web. Given confirmed in-the-wild exploitation, known ransomware use, and 89.5% EPSS, prioritize this in remediation tracking.
Affected
| adobe Flash Player | all versions before 28.0.0.161 |
| redhat Enterprise Linux Desktop (flash-plugin) | Flash Player component before 28.0.0.161 |
| redhat Enterprise Linux Server (flash-plugin) | Flash Player component before 28.0.0.161 |
| redhat Enterprise Linux Workstation (flash-plugin) | Flash Player component before 28.0.0.161 |
Estimated exposure
mass≈ hundreds of millions of desktop installs at time of disclosure; residual unmigrated installs now unknown (Flash is end-of-life) — Flash Player historically shipped on the vast majority of internet-connected PCs (install base on the order of a billion) and Red Hat distributed the plugin in RHEL repositories, so exposure was mass-scale at disclosure; today only legacy…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.
CISA Known Exploited Vulnerability
- Affected
- Adobe Flash Player
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
- Due date
- Ransomware use
- Known
In the news20 stories
60
Threat Brief: Office Documents Can Be Dangerous (But We’ll Continue to Use Them Anyway)
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Threat Brief: Maze Ransomware
Unit 42 issued a threat brief on Maze ransomware, noting an uptick across industries and exploitation of Pulse VPN and IE flaws for initial access.
Palo Alto Networks detected an uptick in Maze ransomware samples across finance, healthcare, government, and other sectors. Maze, a variant of ChaCha ransomware first seen in May 2019, is distributed via weaponized Word/Excel attachments and the Spelevo exploit kit leveraging CVE-2018-15982 and CVE-2018-4878, and has used CVE-2019-11510 (Pulse VPN) and CVE-2018-8174 (Internet Explorer). Operators establish a foothold, escalate privileges, move laterally, and exfiltrate files before encryption for extortion leverage.
55
47