Adobe has released an out-of-band patch for a critical Flash Player vulnerability. Users are encouraged to upgrade as soon as possible. Background On November 20, Adobe released APSB18-44, an out-of-band (OOB) security bulletin to address a zero day vulnerability in Adobe Flash Player versions 31.0.0.148 and earlier for Windows, macOS, Linux and Chrome OS.

Adobe Issues Out-of-Band Patch for Critical Flash Player Vulnerability (CVE-2018-15981)

Flash Player versions 31.0.0.148 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Versions of Adobe Flash Player prior to 31.0.0.153 are unpatched, and therefore affected by a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

The remote Windows host is missing security update KB4477029. It is, therefore, affected by an arbitrary code execution vulnerability in Adobe Flash Player.

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 31.0.0.148. It is therefore affected by an arbitrary code execution vulnerability.

The version of Adobe Flash Player installed on the remote macOS or Mac OS X host is equal or prior to version 31.0.0.148.
It is therefore affected by an arbitrary code execution vulnerability.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:3644 advisory.

  - flash-plugin: Arbitrary code execution vulnerability (APSB18-44) (CVE-2018-15981)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Adobe reports :

- This update resolves a type confusion vulnerability that could lead to arbitrary code execution (CVE-2018-15981).

ID	Name	Product	Family	Severity
700439	Flash Player < 31.0.0.153 RCE (APSB18-44)	Nessus Network Monitor	Web Clients	critical
119095	KB4477029: Security update for Adobe Flash Player (November 2018)	Nessus	Windows : Microsoft Bulletins	critical
119094	Adobe Flash Player <= 31.0.0.148 (APSB18-44)	Nessus	Windows	critical
119093	Adobe Flash Player for Mac <= 31.0.0.148 (APSB18-44)	Nessus	MacOS X Local Security Checks	critical
119076	RHEL 6 : flash-plugin (RHSA-2018:3644)	Nessus	Red Hat Local Security Checks	critical
119057	FreeBSD : Flash Player -- arbitrary code execution (8f128c72-ecf9-11e8-aa00-6451062f0f7a)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-15981

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical