Adobe Flash TextField.htmlText Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=578 There is a use-after-free in the TextField.htmlText setter. If the htmlText the field is set to is an object with toString defined, the toString function can free the...

Adobe Flash MovieClip.attachMovie - Use-After-Free

Adobe Flash MovieClip.attachMovie - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=571 There is a use-after-free in MovieClip.attachMovie. If a string parameter has toString defined, a number parameter has valueOf defined or an object parameter has its...

Adobe Flash TextField.thickness Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=587 There is a use-after-free in the TextField thickness setter. If the thickness parameter is an object with valueOf set to a function which frees the TextField parent, ...

Adobe Flash TextField.text Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=576 There is a use-after-free in the TextField.text setter. If the text the field is set to is an object with toString defined, the toString function can free the field's...

Adobe Flash MovieClip.attachBitmap - Use-After-Free

Adobe Flash MovieClip.attachBitmap - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=593 There is a use-after-free in MovieClip.attachBitmap. If the depth parameter is an object with valueOf defined, this method can free the MovieClip, which is then used...

Adobe Flash TextField.type Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=577 There is a use-after-free in the TextField.type setter. If the type the field is set to is an object with toString defined, the toString function can free the field's...

Adobe Flash TextField.replaceSel - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=585 There is a use-after-free in TextField.replaceSel. If the string parameter of the method is set to an object with toString defined, this method can delete the...

Adobe Flash TextField.sharpness Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=588 There is a use-after-free in the TextField sharpness setter. If the sharpness parameter is an object with valueOf set to a function which frees the TextField parent, ...

Adobe Flash MovieClip.attachBitmap - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=593 There is a use-after-free in MovieClip.attachBitmap. If the depth parameter is an object with valueOf defined, this method can free the MovieClip, which is then used....

Adobe Flash TextField Variable - Use-After Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=583 If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's...

Adobe Flash Selection.SetSelection - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=590 There is a use-after-free in Selection.SetSelection. If it is called with a number parameter, which is an object with valueOf defined, and this function frees the...

Adobe Flash MovieClip.duplicateMovieClip - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=591 There is a use-after-free in MovieClip.duplicateMovieClip. If the depth or movie name parameter provided is an object with toString or valueOf defined, this method can free the MovieClip, which is then used. A minimal...

Adobe Flash TextField.setFormat - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=586 The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method can free the TextField parent, which is subsequently...

Adobe Flash TextField.sharpness Setter - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=588 There is a use-after-free in the TextField sharpness setter. If the sharpness parameter is an object with valueOf set to a function which frees the TextField parent, it is used after it is freed. A minimal PoC is as...

Adobe Flash TextField.tabIndex Setter - Use-After-Free

Adobe Flash TextField.tabIndex Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=574 There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField's parent,...

Adobe Flash TextField.htmlText Setter - Use-After-Free

Adobe Flash TextField.htmlText Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=578 There is a use-after-free in the TextField.htmlText setter. If the htmlText the field is set to is an object with toString defined, the toString function can free...

Adobe Flash - TextField.Variable Setter Use-After-Free

Adobe Flash - TextField.Variable Setter Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=579 There is a use-after-free in the TextField.variable setter. If the variable name that is added is an object with toString defined, the toString function can free...

Adobe Flash TextField.sharpness Setter - Use-After-Free

Adobe Flash TextField.sharpness Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=588 There is a use-after-free in the TextField sharpness setter. If the sharpness parameter is an object with valueOf set to a function which frees the TextField...

Adobe Flash MovieClip.attachMovie - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=571 There is a use-after-free in MovieClip.attachMovie. If a string parameter has toString defined, a number parameter has valueOf defined or an object parameter has its...

Adobe Flash TextField.replaceText - Use-After-Free

Adobe Flash TextField.replaceText - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=584 There is a use-after-free in the TextField.replaceText function. If the function is called with a string parameter with toString defined, or an integer parameter with...