Hhj4ckH1:119653Internet Bug Bounty: Adobe Flash Player ASnative(900,1).call(MovieClip) Use-After-Free Vulnerability
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.019 Low
EPSS
Percentile
87.0%
I. Summary
Adobe Flash Player is prone to a vulnerability which leads to Use-After-Free.
II. Description
If the ASnative(900,1) is invoked with MovieClip instance and getter properties associated with swfRoot where the getter method includes a call to removeMovieClip(), the MovieClip instance is used after it is freed.
Latest version of Adobe Flash Player 20.0.0.267 has been tested under Windows 7.
III. Impact
Use-After-Free
IV. Credit
Wen Guanxing from Venustech ADLAB is credited for this vulnerability.
It has been assigned by Adobe as CVE-2016-0982
https://helpx.adobe.com/security/products/flash-player/apsb16-04.html
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.019 Low
EPSS
Percentile
87.0%