A vulnerability, which was classified as critical, was found in Adobe Flash Player up to 32.0.0.171 (Multimedia Player Software). This affects an unknown functionality. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Adobe Flash Player versions 32.0.0.171 and earlier, 32.0.0.171 and earlier, and 32.0.0.171 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

The bug was discovered 05/14/2019. The weakness was released 05/14/2019 as APSB19-26 as confirmed security bulletin (Website). The advisory is shared at helpx.adobe.com. This vulnerability is uniquely identified as CVE-2019-7837 since 02/12/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 371780 (Adobe Security Update for Flash Player (APSB19-26)).

Upgrading to version 32.0.0.192 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Productinfo

Type

• Multimedia Player Software

Vendor

• Adobe

Name

• Flash Player

Version

• 32.0.0.171

License

• free

Support

• end of life

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion