CVE-2018-5001

flash-plugin: Information Disclosure vulnerabilities (APSB18-19)

Adobe Flash Player versions 29.0.0.171 and earlier have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

CVSS 3.0 · 6.5 Medium EPSS 13.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 9 more

CVE-2018-5000

flash-plugin: Information Disclosure vulnerabilities (APSB18-19)

Adobe Flash Player versions 29.0.0.171 and earlier have an Integer Overflow vulnerability. Successful exploitation could lead to information disclosure.

CVSS 3.0 · 6.5 Medium EPSS 13.7% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 9 more

CVE-2018-4945

flash-plugin: Arbitrary Code Execution vulnerability (APSB18-19)

Adobe Flash Player versions 29.0.0.171 and earlier have a Type Confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

CVSS 3.0 · 8.8 High EPSS 6.7% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 9 more

CVE-2018-4944

flash-plugin: Arbitrary Code Execution vulnerability (APSB18-16)

Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

CVSS 3.0 · 9.8 Critical EPSS 8.5% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Macos Chrome Os and 8 more

CVE-2018-4937

flash-plugin: Remote Code Execution vulnerabilities (APSB18-08)

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

CVSS 3.1 · 8.8 High EPSS 25.5% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2018-4936

flash-plugin: Information Disclosure vulnerabilities (APSB18-08)

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Heap Overflow vulnerability. Successful exploitation could lead to information disclosure.

CVSS 3.1 · 6.5 Medium EPSS 24.5% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2018-4935

flash-plugin: Remote Code Execution vulnerabilities (APSB18-08)

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

CVSS 3.1 · 8.8 High EPSS 25.5% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2018-4934

flash-plugin: Information Disclosure vulnerabilities (APSB18-08)

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

CVSS 3.1 · 6.5 Medium EPSS 19.7% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2018-4933

flash-plugin: Information Disclosure vulnerabilities (APSB18-08)

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

CVSS 3.1 · 6.5 Medium EPSS 4.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2018-4932

flash-plugin: Remote Code Execution vulnerabilities (APSB18-08)

Adobe Flash Player versions 29.0.0.113 and earlier have an exploitable Use-After-Free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

CVSS 3.1 · 8.8 High EPSS 5.1% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2018-4920

flash-plugin: Type Confusion - remote code execution vulnerability (APSB18-05)

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

CVSS 3.1 · 8.8 High EPSS 7.6% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2018-4919

flash-plugin: Use After Free - remote code execution vulnerability (APSB18-05)

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

CVSS 3.1 · 8.8 High EPSS 7.4% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Flash Player Desktop Runtime Mac Os X and 6 more

CVE-2018-4877

flash-plugin: use-after-free causing remote code execution (APSB18-03)

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. This vulnerability occurs due to a dangling pointer in the Primetime SDK related to media player's quality of service functionality. A successful attack can lead to arbitrary code execution.

CVSS 3.0 · 9.8 Critical EPSS 8.3% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Macos Chrome Os and 8 more

CVE-2018-4871

flash-plugin: out-of-bounds read causing information leak (APSB18-01)

An Out-of-bounds Read issue was discovered in Adobe Flash Player before 28.0.0.137. This vulnerability occurs because of computation that reads data that is past the end of the target buffer. The use of an invalid (out-of-range) pointer offset during access of internal data structure fields causes the vulnerability. A successful attack can lead to sensitive data exposure.

CVSS 3.0 · 7.5 High EPSS 5.5% KEV · Not listed

Vendors

Adobe Apple Google and 3 more

Products

Flash Player Macos Chrome Os and 8 more

CVE-2018-4868

exiv2: Excessive memory allocation in Exiv2::Jp2Image::readMetadata function in jp2image.cpp

The Exiv2::Jp2Image::readMetadata function in jp2image.cpp in Exiv2 0.26 allows remote attackers to cause a denial of service (excessive memory allocation) via a crafted file.

CVSS 3.0 · 5.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Exiv2 Redhat

Products

Exiv2 Enterprise Linux

CVE-2018-4300

cups: Session cookie generated by the CUPS web interface is easy to guess

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.

CVSS 3.0 · 5.9 Medium EPSS 1.8% KEV · Not listed

Vendors

Apple Redhat

Products

Cups Enterprise Linux

CVE-2018-4204

webkitgtk: memory corruption processing maliciously crafted web content

An issue was discovered in certain Apple products. iOS before 11.4 is affected. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

CVSS 3.0 · 8.8 High EPSS 3.2% KEV · Not listed

Vendors

Apple Microsoft Redhat

Products

Icloud Iphone Os Itunes and 4 more

CVE-2018-4200

webkitgtk: memory corruption processing maliciously crafted web content

An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers a WebCore::jsElementScrollHeightGetter use-after-free.

CVSS 3.0 · 8.8 High EPSS 10.0% KEV · Not listed

Vendors

Apple Canonical Microsoft and 1 more

Products

Icloud Iphone Os Itunes and 5 more

CVE-2018-4181

cups: Manipulation of cupsd.conf by a local attacker resulting in limited reads of arbitrary files as root

In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Canonical Debian and 1 more

Products

Mac Os X Ubuntu Linux Debian Linux and 1 more

CVE-2018-4180

cups: Local privilege escalation to root due to insecure environment variable handling

In macOS High Sierra before 10.13.5, an issue existed in CUPS. This issue was addressed with improved access restrictions.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Canonical Debian and 1 more

Products

Mac Os X Ubuntu Linux Debian Linux and 1 more