Heap-based buffer overflow in Adobe Flash Player - CVE-2018-4936

Vulnerability identifier: #VU11679

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-4936

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to heap-based buffer overflow when handling malicious input. A remote attacker can trick the victim into opening a specially crafted .swf file, trigger memory corruption and access arbitrary files.

Adobe Flash Player
Adobe Flash Player for Microsoft Windows
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop

Update to version 29.0.0.140.

• https://helpx.adobe.com/security/products/flash-player/apsb18-08.html

• Multiple vulnerabilities in Adobe Flash Player
• Microsoft Windows update for Adobe Flash Player
• Gentoo update for Adobe Flash Player
• Red Hat update for Adobe Flash Player