Adobe Flash Player Use-After-Free Vulnerability

高 7.8悪用確認済み（CISA KEV）CVE-2018-4878 · 06/02/2018 公開 · 17/06/2026 更新

Adobe Flash Player Use-After-Free Vulnerability. 悪用が確認されています：CISA は 03/11/2021 にこの脆弱性を「既知の悪用された脆弱性（KEV）」カタログに追加しました。影響を受けるシステムは緊急に修正してください。ランサムウェア攻撃での使用が確認されています。

パッケージ	影響を受けるバージョン	修正済みバージョン
flash player adobe	`< 28.0.0.161`	`28.0.0.161`

概要

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution. This was exploited in the wild in January and February 2018.

参考情報

blog.talosintelligence.com/2018/02/group-123-goes-wild.html · Technical Description
securityfocus.com/bid/102893 · Broken Link
securitytracker.com/id/1040318 · Broken Link
access.redhat.com/errata/RHSA-2018:0285 · Third Party Advisory
blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign · Third Party Advisory
InQuest/malware-samples · Third Party Advisory
vysec/CVE-2018-4878 · Third Party Advisory
helpx.adobe.com/security/products/flash-player/apsb18-03.html · Vendor Advisory
securingtomorrow.mcafee.com/mcafee-labs/hackers-bypassed-adobe-flash-protection-mechanism · Exploit
threatpost.com/adobe-flash-player-zero-day-spotted-in-the-wild/129742 · Third Party Advisory
darkreading.com/threat-intelligence/adobe-flash-vulnerability-reappears-in-malicious-word-files/d/d-id/1331139 · Press/Media Coverage
exploit-db.com/exploits/44412 · Exploit
fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html · Third Party Advisory
trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/north-korean-hackers-allegedly-exploit-adobe-flash-player-vulnerability-cve-2018-4878-against-south-korean-targets · Technical Description
cisagov/vulnrichment · Issue Tracking
cisa.gov/known-exploited-vulnerabilities-catalog · Third Party Advisory
CISA KEV · CVE-2018-4878

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン