PT-2018-13323 · Adobe+1 · Flash Player+1

Published 2018-12-05 · Updated 2019-01-28 · CVE-2018-15983

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Flash Player versions 31.0.0.153 and earlier Adobe Flash Player versions 31.0.0.108 and earlier

Description A vulnerability in Adobe Flash Player allows attackers to escalate privileges. The issue is related to insecure library loading, also known as dll hijacking. Successful exploitation could lead to privilege escalation.

Recommendations For Adobe Flash Player versions 31.0.0.153 and earlier, update to a version later than 31.0.0.153 to resolve the issue. For Adobe Flash Player versions 31.0.0.108 and earlier, update to a version later than 31.0.0.108 to resolve the issue. As a temporary workaround, consider restricting the loading of external libraries to minimize the risk of exploitation.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

ALT-PU-2019-1042

CVE-2018-15983

MGASA-2018-0478

Affected Products

Alt Linux

Flash Player

References · 10

• https://osv.dev/vulnerability/MGASA-2018-0478 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-15983 · Security Note
• https://advisories.mageia.org/MGASA-2018-0478.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-15983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15983 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15983 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-15983 · Vendor Advisory
• https://helpx.adobe.com/security/products/flash-player/apsb18-42.html · Vendor Advisory
• https://bugs.mageia.org/show_bug.cgi?id=23950 · Note
• http://securityfocus.com/bid/106108 · Note