Vulnerabilities > CVE-2018-12824 - Out-of-bounds Read vulnerability in multiple products

047910
CVSS 4.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE

Summary

Adobe Flash Player 30.0.0.134 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

Vulnerable Configurations

Part Description Count
Application
Adobe
120
OS
Apple
1
OS
Microsoft
3
OS
Google
1
OS
Linux
1
OS
Redhat
3

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-2435.NASL
    descriptionAn update for flash-plugin is now available for Red Hat Enterprise Linux 6 Supplementary. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 30.0.0.154. Security Fix(es) : * flash-plugin: Information Disclosure vulnerabilities (APSB18-25) (CVE-2018-12824, CVE-2018-12826, CVE-2018-12827) * flash-plugin: Security Mitigation Bypass vulnerability (APSB18-25) (CVE-2018-12825) * flash-plugin: Privilege Escalation vulnerability (APSB18-25) (CVE-2018-12828) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id111776
    published2018-08-16
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111776
    titleRHEL 6 : flash-plugin (RHSA-2018:2435)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_98B603C89FF311E8AD636451062F0F7A.NASL
    descriptionAdobe reports : - This update resolves out-of-bounds read vulnerabilities that could lead to information disclosure (CVE-2018-12824, CVE-2018-12826, CVE-2018-12827). - This update resolves a security bypass vulnerability that could lead to security mitigation bypass (CVE-2018-12825). - This update resolves a component vulnerability that could lead to privilege escalation (CVE-2018-12828).
    last seen2020-06-01
    modified2020-06-02
    plugin id111721
    published2018-08-15
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111721
    titleFreeBSD : Flash Player -- multiple vulnerabilities (98b603c8-9ff3-11e8-ad63-6451062f0f7a)
  • NASL familyWindows
    NASL idFLASH_PLAYER_APSB18-25.NASL
    descriptionThe version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 30.0.0.134. It is therefore affected by multiple vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id111683
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111683
    titleAdobe Flash Player <= 30.0.0.134 (APSB18-25)
  • NASL familyWindows : Microsoft Bulletins
    NASL idSMB_NT_MS18_AUG_4343902.NASL
    descriptionThe remote Windows host is missing security update KB4343902. It is, therefore, affected by multiple remote code execution vulnerabilities in Adobe Flash Player.
    last seen2020-06-01
    modified2020-06-02
    plugin id111691
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111691
    titleKB4343902: Security update for Adobe Flash Player (August 2018)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_FLASH_PLAYER_APSB18-25.NASL
    descriptionThe version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 30.0.0.134. It is therefore affected by multiple vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id111681
    published2018-08-14
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111681
    titleAdobe Flash Player for Mac <= 30.0.0.134 (APSB18-25)

Redhat

advisories
rhsa
idRHSA-2018:2435
rpmsflash-plugin-0:30.0.0.154-1.el6_10