Adobe Flash Sound.setTransform - Use-After-Free

Adobe Flash Sound.setTransform - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=568 There is a use-after-free in Sound.setTransform. If a transform value is set to an object with valueOf defined, it can free the transform before the values are set. A...

Adobe Flash Sound.setTransform - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=568 There is a use-after-free in Sound.setTransform. If a transform value is set to an object with valueOf defined, it can free the transform before the values are set. A...

Adobe Flash Sound.setTransform - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=568 There is a use-after-free in Sound.setTransform. If a transform value is set to an object with valueOf defined, it can free the transform before the values are set. A minimal PoC is as follows:...

Adobe Flash TextField.thickness Setter - Use-After-Free

Adobe Flash TextField.thickness Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=587 There is a use-after-free in the TextField thickness setter. If the thickness parameter is an object with valueOf set to a function which frees the TextField...

Adobe Flash Selection.SetSelection - Use-After-Free

Adobe Flash Selection.SetSelection - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=590 There is a use-after-free in Selection.SetSelection. If it is called with a number parameter, which is an object with valueOf defined, and this function frees the...

Adobe Flash TextField.type Setter - Use-After-Free

Adobe Flash TextField.type Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=577 There is a use-after-free in the TextField.type setter. If the type the field is set to is an object with toString defined, the toString function can free the field's...

Adobe Flash MovieClip.localToGlobal - Use-After-Free

Adobe Flash MovieClip.localToGlobal - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=570 There is a use-after-free issue in MovieClip.localToGlobal. If the Number constructor is overwritten with a new constructor and MovieClip.localToGlobal is called wi...

Adobe Flash MovieClip.localToGlobal - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=570 There is a use-after-free issue in MovieClip.localToGlobal. If the Number constructor is overwritten with a new constructor and MovieClip.localToGlobal is called with...

Adobe Flash TextField.setFormat - Use-After-Free

Adobe Flash TextField.setFormat - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=586 The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method can...

Adobe Flash MovieClip.startDrag - Use-After-Free

Adobe Flash MovieClip.startDrag - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=592 There is a use-after-free in MovieClip.startDrag. If a parameter an object with valueOf defined, this method can free the MovieClip, which is then used. A minimal POC...

Adobe Flash TextField.Variable Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=579 There is a use-after-free in the TextField.variable setter. If the variable name that is added is an object with toString defined, the toString function can free the...

Adobe Flash MovieClip.startDrag - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=592 There is a use-after-free in MovieClip.startDrag. If a parameter an object with valueOf defined, this method can free the MovieClip, which is then used. A minimal POC...

Adobe Flash - TextField Use-After Free

Adobe Flash - TextField Use-After Free Source: https://code.google.com/p/google-security-research/issues/detail?id=583 If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A...

Adobe Flash - 'TextField' Use-After Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=583 If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A minimal PoC is as follows: var mc =...

Adobe Flash MovieClip.startDrag - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=592 There is a use-after-free in MovieClip.startDrag. If a parameter an object with valueOf defined, this method can free the MovieClip, which is then used. A minimal POC follows: this.createEmptyMovieClip"mc", 1;...

Adobe Flash TextField.thickness Setter - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=587 There is a use-after-free in the TextField thickness setter. If the thickness parameter is an object with valueOf set to a function which frees the TextField parent, it is used after it is freed. A minimal PoC is as...

Adobe Flash TextField.tabIndex Setter - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=574 There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField's parent, leading to a use-after-free. A minimal PoC follows: var...

Adobe Flash Selection.SetSelection - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=590 There is a use-after-free in Selection.SetSelection. If it is called with a number parameter, which is an object with valueOf defined, and this function frees the parent of the TextField parameter, the object is used...

Adobe Flash TextField.replaceSel - Use-After-Free

Adobe Flash TextField.replaceSel - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=585 There is a use-after-free in TextField.replaceSel. If the string parameter of the method is set to an object with toString defined, this method can delete the...

Adobe Flash TextField.text Setter - Use-After-Free

Adobe Flash TextField.text Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=576 There is a use-after-free in the TextField.text setter. If the text the field is set to is an object with toString defined, the toString function can free the field's...