Adobe Patches Zero-Day Flash Flaw

Summary: Adobe released an emergency update for a critical Flash Player vulnerability, CVE-2018-5002, that is being actively exploited in limited, targeted attacks against Windows users via Microsoft Office documents with embedded malicious Flash content distributed by email. The flaw affects Flash v. 29.0.0.171 and earlier, and the patched version is v. 30.0.0.113 for Windows, Mac, Linux and Chrome OS, credited to Chinese security firm Qihoo 360, which said the exploit targeted individuals and companies in Doha, Qatar and is believed tied to a nation-state cyber-espionage campaign.
Key Takeaway: The exploit arrives as an Office document in an email, so the delivery path is one your users open every day, and Qihoo 360 tied it to a nation-state espionage campaign against targets in Doha, Qatar.

Read the original at Krebs on Security ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2018-5002
Related: CVE-2018-5002: Adobe Flash Player Stack-based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · May 23, 2022
Slicing and Dicing CVE-2018-5002 Payloads: New CHAINSHOT Malware Cyber Risks ·
New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026