Adobe Flash Player APSB16-29 Multiple Unspecified Memory Corruption Vulnerabilities

Description Adobe Flash Player is prone to multiple unspecified memory-corruption vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected applications. Failed exploit attempts will likely cause a denial-of-service condition...

Adobe Flash Player Use After Free (APSB16-29: CVE-2016-4279)

This vulnerability is an instance of a use after free vulnerability. A constraint for exploitation of this vulnerability is that the memory area of the freed object is reused by another object. The mismatch between the old and the new object can provide attacker with an unintended memory access...

Adobe Flash Player Memory Corruption (APSB16-29: CVE-2016-4284)

A memory corruption vulnerability exist in Adobe Flash Player. The vulnerability is caused by a crafted SWF file which causes an out of bounds memory access. A remote attacker can exploit this issue in order to trigger an access violation exception...

Adobe Flash Player Memory Corruption (APSB16-29: CVE-2016-4282)

A memory corruption vulnerability has been reported in Adobe Flash Player. The vulnerability is due to an error in Adobe Flash Player while parsing a specially crafted SWF file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted SWF file...

MS16-117: Security Update for Adobe Flash Player (3188128)

The remote Windows host is missing KB3188128. It is, therefore, affected by multiple vulnerabilities : - Multiple security bypass vulnerabilities exist that allow an unauthenticated, remote attacker to disclose sensitive information. CVE-2016-4271, CVE-2016-4277, CVE-2016-4278 - Multiple...

Adobe Flash - Transform.colorTranform Getter Info Leak

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=845 There is an info leak in the Transform.colorTranform getter. If the constructor for ColorTransform is overwritten with a getter using addProperty, this getter will execute whe...

Adobe Flash - Method Calls Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846 If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a...

Adobe Flash - Transform.colorTranform Getter Infomation Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=845 There is an info leak in the Transform.colorTranform getter. If the constructor for ColorTransform is overwritten with a getter using addProperty, this getter will execute when fetching the constructor, which can then free the...

Adobe Flash - Transform.colorTranform Getter Infomation Leak

Adobe Flash - Transform.colorTranform Getter Infomation Leak Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=845 There is an info leak in the Transform.colorTranform getter. If the constructor for ColorTransform is overwritten with a getter using addProperty, this getter will...

Adobe Flash - Method Calls Use-After-Free

Adobe Flash - Method Calls Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846 If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a...

Adobe Flash - Method Calls Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846 If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a user-after-free. A minimal PoC is as follows: var mc ...

Adobe Flash - BitmapData.copyPixels Use-After-Free

Adobe Flash - BitmapData.copyPixels Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843 There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert...

Adobe Flash - Selection.setFocus Use-After-Free

Adobe Flash - Selection.setFocus Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=841 There is a user-after-free in Selection.setFocus. It is a static method, but if it is called with a this object, it will be called on that object's thread. Then, if it calls into...

Adobe Flash - MovieClip Transform Getter Use-After-Free

Adobe Flash - MovieClip Transform Getter Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844 There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip...

Adobe Flash - Stage.align Setter Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free prevention changes. This conversion can invoke script,...

SUSE SLED12 Security Update : flash-player (SUSE-SU-2016:1613-1)

Adobe flash-player was updated to 11.2.202.626 to fix the following security issues : Security update to 11.2.202.626 boo984695 : - APSB16-18, CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132,...

Adobe Flash - BitmapData.copyPixels Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843 There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert future parameters, even though it has already been...

Adobe Flash - Stage.align Setter Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free...

Adobe Flash - Stage.align Setter Use-After-Free

Adobe Flash - Stage.align Setter Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free preventi...

Adobe Flash - BitmapData.copyPixels Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843 There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert...