CVE-2018-15982 Adobe Flash Player Use-After-Free
Attackers can execute arbitrary code via a use-after-free flaw in Adobe Flash Player, requiring users to update the plugin.
- Exploited in the wild
- Since 15 Feb 2022
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-15982?
CVE-2018-15982 is a high-severity use after free vulnerability in Adobe Flash Player, published on 18 Jan 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Weakness: CWE-416
Which versions are affected by CVE-2018-15982?
It affects 5 products.
Linux distribution packages (1)
flash-plugin Red Hat:rhel_extras:6 | All versions | 0:32.0.0.101-1.el6_10 |
Products include Adobe Flash Player, Adobe Flash Player Installer, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation.
How do I fix CVE-2018-15982?
Apply the vendor's patch. US federal agencies must fix it by 15 Aug 2022.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2018-15982 being exploited?
Yes. Attackers have exploited CVE-2018-15982 in the wild since at least 15 Feb 2022, including in ransomware campaigns.
Public exploit code: 1 Exploit-DB entry and 7 proofs of concept on GitHub.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as GHSA-26v8-ffh8-7vqg, RHSA-2018:3795, UBUNTU-CVE-2018-15982.