Vulners
Lucene search
Adobe Flash - Heap Buffer Overflow Loading '.FLV' File with Nellymoser Audio Codec
🗓️ 19 Aug 2015 00:00:00Reported by Google Security ResearchType 
exploitdb🔗 www.exploit-db.com👁 33 Views
10
Source: https://code.google.com/p/google-security-research/issues/detail?id=425&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id
To reproduce, host the attached files appropriately and:
http://localhost/LoadMP4.swf?file=crash4000368.flv
If there is no crash at first, refresh the page a few times.
With a debugger attached to 64-bit Flash in Chrome Linux, the crash manifests like this:
=> 0x00007f7789d081bb <__memmove_ssse3_back+443>: movaps %xmm1,-0x10(%rdi)
rdi 0x7f7778d69200
7f777894b000-7f7778d69000 rw-p 00000000 00:00 0
7f7778d69000-7f7778d88000 ---p 00000000 00:00 0
This looks very like a heap-based buffer overflow that just happens to have walked off the end of the committed heap.
Also, this bug bears disturbing similarities to CVE-2015-3043, see for example: https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37879.zipData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
19 Aug 2015 00:00Current
9.7High risk
Vulners AI Score9.7
CVSS 3.17.8 - 9.8
CVSS 210
EPSS0.87397
SSVC