FILE-FLASH Adobe Flash Player Vector.String class out-of-bounds read attempt
This event is generated when a maliciously crafted Flash movie is detected traversing the network.
Attempted User Privilege Gain
CVSS base score 7.5
CVSS impact score 3.6
CVSS exploitability score 3.9
Confidentiality Impact HIGH
Integrity Impact NONE
Availability Impact NONE
The vulnerability is caused by the computation that reads data past the end of the intended buffer; the computation is part of the ActionScript 3 VM that handles native code constructor calls. Crafted SWF input triggers the flawed computation where pointer arithmetic is not appropriately checked against boundary conditions, which leads to memory write operation through the pointer that points to an invalid memory location. The vulnerability is a result of out of range pointer offset that is used to access sub-elements of an internal data structure. An attacker can potentially leverage the vulnerability to leak sensitive data (e.g., memory addresses).
CVE-2018-12826: Adobe Flash Player 22.214.171.124 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
- adobe flash_player 126.96.36.199
- redhat enterpriselinuxdesktop 6.0
- redhat enterpriselinuxserver 6.0
- redhat enterpriselinuxworkstation 6.0
Ease of attack
- Cisco's Talos Intelligence Group