CVE-2020-9633 Use after free in Adobe Flash Player
Attackers can execute arbitrary code via a use-after-free flaw in Adobe Flash Player, requiring users to update the plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-9633?
CVE-2020-9633 is a critical use after free vulnerability in Adobe Flash Player, published on 12 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Adobe Flash Player Desktop Runtime 32.0.0.371 and earlier, Adobe Flash Player for Google Chrome 32.0.0.371 and earlier, and Adobe Flash Player for Microsoft Edge and Internet Explorer 32.0.0.330 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution.
Weakness: CWE-416
Which versions are affected by CVE-2020-9633?
It affects 2 products.
Linux distribution packages (1)
flash-plugin Red Hat:rhel_extras:6 | All versions | 0:32.0.0.387-1.el6_10 |
Products include Adobe Flash Player, Adobe Flash Player Desktop Runtime.
How do I fix CVE-2020-9633?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2020-9633 being exploited?
There is no known exploitation of CVE-2020-9633 in the wild and no public exploit code.
Other vulnerabilities in Adobe Flash Player
Sources
Also known as GHSA-hfp4-4377-7cc7, MGASA-2020-0264, RHSA-2020:2547, UBUNTU-CVE-2020-9633.