SB2019061104 - Multiple vulnerabilities in Adobe Flash Player

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019061104

SB2019061104 - Multiple vulnerabilities in Adobe Flash Player

Published: June 11, 2019 Updated: July 1, 2021

Security Bulletin ID SB2019061104
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Use-after-free (CVE-ID: CVE-2019-7845)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing .swf files. A remote attacker can create a specially crafted .swf file, trick the victim to open it, trigger use-after-free error and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.


2) Overly permissive cross-domain whitelist (CVE-ID: CVE-2019-8075)

The vulnerability allows a remote attacker to bypass the CORS protection mechanism.

The vulnerability exists due to incorrect processing of the "Origin" HTTP header that is supplied within HTTP request in Adobe Flash player. A remote attacker can bypass implemented same origin policy restrictions and gain access to sensitive information from another domain.


Remediation

Install update from vendor's website.

References