CVE-2018-15982

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to...

Basic Information

CVE State: PUBLISHED
Reserved Date: August 28, 2018
Published Date: January 18, 2019
Last Updated: February 04, 2025
Vendor: n/a
Product: n/a
Description: Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 -

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2022-02-15 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2018-12-06 09:24:47 UTC) Source
Used in Malware: Yes (added 2022-02-15 00:00:00 UTC) Source

References

https://access.redhat.com/errata/RHSA-2018:3795 https://helpx.adobe.com/security/products/flash-player/apsb18-42.html https://www.exploit-db.com/exploits/46051/ http://www.securityfocus.com/bid/106116

Known Exploited Vulnerability Information

Source	Added Date
CISA	2022-02-15 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

SyFi/CVE-2018-15982

Type: github • Created: 2018-12-20 02:40:22 UTC • Stars: 5

Flash 2018-15982 UAF

scanfsec/CVE-2018-15982

Type: github • Created: 2018-12-12 04:07:08 UTC • Stars: 28

Aggressor Script to launch IE driveby for CVE-2018-15982.

jas502n/CVE-2018-15982_EXP_IE

Type: github • Created: 2018-12-12 02:41:31 UTC • Stars: 11

CVE-2018-15982_EXP_IE

Ridter/CVE-2018-15982_EXP

Type: github • Created: 2018-12-10 04:53:31 UTC • Stars: 181

exp of CVE-2018-15982

Ormicron/CVE-2018-15982_PoC

Type: github • Created: 2018-12-06 09:24:47 UTC • Stars: 14

CVE-2018-15982_PoC

FlatL1neAPT/CVE-2018-15982

Type: github • Created: 2018-12-05 23:41:37 UTC • Stars: 0

Flash sources for CVE-2018-15982 used by NK