| Severity | Critical |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE ID | CVE-2018-15982 CVE-2018-15983 |
| CVSSv3 |
8.4 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C] 6.5 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] |
| CWE ID |
CWE-416 CWE-427 |
| Exploitation vector | Network |
| Public exploit | Vulnerability #1 is being exploited in the wild. |
| Vulnerable software |
Adobe Flash Player |
| Vulnerable software versions |
Adobe Flash Player on Windows Server 2019 Adobe Flash Player on Windows 10 Version 1803 for ARM64-based Systems Adobe Flash Player on Windows 10 Version 1809 for ARM64-based Systems Show more |
| Vendor URL | Microsoft |
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error when processing SWF files. A remote attacker can create a specially crafted .swf file, trick the victim to open it and execute arbitrary code on system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
Note: this vulnerability is being exploited in the wild.
Install updates from Microsoft website.
External linkshttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180031
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote attacker can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.
RemediationInstall updates from Microsoft website.
External linkshttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV180031