Adobe Flash - Uninitialized Stack Parameter Access in Object.unwatch UaF Fix

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=716 The ActionScript parameter conversion in the fix for an issue in the December Flash bulletin https://helpx.adobe.com/security/products/flash-player/apsb15-32.html, most likely one of the UaFs reported by Yuki Chen can sometimes...

Adobe Flash - Shape Rendering Crash

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=721 The attached fuzz case causes a crash in shape rendering. Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39608.zip...

Adobe Flash - Uninitialized Stack Parameter Access in AsBroadcaster.broadcastMessage UaF Fix

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=717 The ActionScript parameter conversion in the fix for an issue in the December Flash bulletin https://helpx.adobe.com/security/products/flash-player/apsb15-32.html, most likely one of the UaFs reported by Yuki Chen can sometimes...

Adobe Flash - Sprite Creation Use-After-Free

Adobe Flash - Sprite Creation Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=718 There is a use-after-free in Sprite Creation. If a Sprite is created, and then the handler for the frameConstructed event triggers a remove object action, the Sprite is then used aft...

Adobe Flash - Shape Rendering Crash

Adobe Flash - Shape Rendering Crash Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=721 The attached fuzz case causes a crash in shape rendering. Proof of Concept: https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39608.zip...

Adobe Flash - Uninitialized Stack Parameter Access in AsBroadcaster.broadcastMessage UaF Fix

Adobe Flash - Uninitialized Stack Parameter Access in AsBroadcaster.broadcastMessage UaF Fix Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=717 The ActionScript parameter conversion in the fix for an issue in the December Flash bulletin...

Adobe Flash - Uninitialized Stack Parameter Access in Object.unwatch UaF Fix

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=716 The ActionScript parameter conversion in the fix for an issue in the December Flash bulletin https://helpx.adobe.com/security/products/flash-player/apsb15-32.html, most likely...

Adobe Flash - Zlib Codec Heap Overflow

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=720 There is a heap overflow in the Zlib codecs used when playing flv files in flash. Sample flv files are attached. Load http://127.0.0.1/LoadMP42.swf?file=smalloverflow.flv to...

Adobe Flash - Uninitialized Stack Parameter Access in MovieClip.swapDepths UaF Fix

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=715 The ActionScript parameter conversion in the fix for issue 403 https://code.google.com/p/google-security-research/issues/detail?id=403 can sometimes access a parameter on the...

Adobe Flash - Zlib Codec Heap Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=720 There is a heap overflow in the Zlib codecs used when playing flv files in flash. Sample flv files are attached. Load http://127.0.0.1/LoadMP42.swf?file=smalloverflow.flv to reproduce. Proof of Concept:...

Pwn2Own Day Two: Safari, Microsoft Edge Go Down Winner Announced

In the end, it was a nail-biter pitting Tencent Security Team Sniper KeenLab and PC Manager against JungHoon Lee lokihardt for the title of Master of Pwn for Pwn2Own 2016. After a tense last two minutes of the competition, it was Tencent Security Team Sniper and its successful code execution of a...

Typosquatters Target Mac Users With New .OM Domain Scam

Typosquatters are targeting Apple computer users with malware in a recent campaign that snares clumsy web surfers who mistakenly type .om instead of .com when surfing the web. According to Endgame security researchers, the top level domain for Middle Eastern country Oman .om is being exploited by...

SUSE SLED11 Security Update : flash-player (SUSE-SU-2016:0716-1)

Adobe flash-player was updated to 11.2.202.577 to fix the following list of security issues bsc970547 : These updates resolve integer overflow vulnerabilities that could lead to code execution CVE-2016-0963, CVE-2016-0993, CVE-2016-1010. These updates resolve use-after-free vulnerabilities that...

RHEL 5 / 6 : flash-plugin (RHSA-2016:0438)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:0438 advisory. The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update fixes multiple...

Gentoo Security Advisory GLSA 201603-07

Gentoo Linux Local Security Checks GLSA 201603-07 SPDX-FileCopyrightText: 2016 Eero Volotinen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later ifdescription...

GLSA-201603-07 : Adobe Flash Player: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201603-07 Adobe Flash Player: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Adobe Flash Player. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly...

SUSE SLED12 Security Update : flash-player (SUSE-SU-2016:0715-1)

Adobe flash-player was updated to 11.2.202.577 to fix the following list of security issues bsc970547 : These updates resolve integer overflow vulnerabilities that could lead to code execution CVE-2016-0963, CVE-2016-0993, CVE-2016-1010. These updates resolve use-after-free vulnerabilities that...

openSUSE Security Update : Adobe Flash Player (openSUSE-2016-325)

This update to Adobe Flash Player 11.2.202.577 fixes a number of vulnerabilities that could have allowed remote attackers to execute arbitrary code through crafted content. boo970547 - APSB16-08, CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987,...

openSUSE Security Update : Adobe Flash Player (openSUSE-2016-335)

This update to Adobe Flash Player 11.2.202.577 fixes a number of vulnerabilities that could have allowed remote attackers to execute arbitrary code through crafted content. boo970547 - APSB16-08, CVE-2016-0960, CVE-2016-0961, CVE-2016-0962, CVE-2016-0963, CVE-2016-0986, CVE-2016-0987,...

Adobe Flash Player Memory Corruption Vulnerability (CNVD-2016-01616)

Adobe Flash Player is a multimedia player product; Adobe AIR SDK and Adobe AIR SDK & Compiler are both standard development kits for Adobe AIR. A memory corruption vulnerability exists in Adobe Flash Player, which could be exploited by remote attackers to construct a malicious web page that could...