Adobe Flash - swapDepths Use-After-Free

Adobe Flash - swapDepths Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=403&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a use-after-free in MovieClip.swapDepths, a POC is as follows: var clip1 =...

Adobe Flash - Pointer Crash in XML Handling

Adobe Flash - Pointer Crash in XML Handling Source: https://code.google.com/p/google-security-research/issues/detail?id=400&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id The attached sample file, signalsigsegv7ffff637297a8900e3f87b25c25db8f9ec3c975f8c1211cc.swf, crashes,...

Adobe Flash AS2 - Color.setRGB Use-After-Free

Adobe Flash AS2 - Color.setRGB Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=367&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Deadline tracking for Chromium VRP bug https://code.google.com/p/chromium/issues/detail?id=484610...

Adobe Flash AS2 Use-After-Free In TextField.filters

Source: https://code.google.com/p/google-security-research/issues/detail?id=444&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for https://code.google.com/p/chromium/issues/detail?id=498984 Credit is to bilou, working with the Chromium Vulnerability Rewards Progra...

Adobe Flash - FileReference Class Type Confusion

Adobe Flash - FileReference Class Type Confusion Source: https://code.google.com/p/google-security-research/issues/detail?id=422&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a type confusion issue in the TextFormat constructor that is reachable because the...

Adobe Flash AS2 - textfield.filters Use-After-Free (2)

Adobe Flash AS2 - textfield.filters Use-After-Free 2 Source: https://code.google.com/p/google-security-research/issues/detail?id=342&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for https://code.google.com/p/chromium/issues/detail?id=480496 Credit is to bilou,...

Adobe Flash - attachMovie Use-After-Free

Adobe Flash - attachMovie Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=391&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a use-after-free in attachMovie due to the initObject. If the initObject contains an object that...

Adobe Flash AS2 - textfield.filters Use-After-Free (1)

Adobe Flash AS2 - textfield.filters Use-After-Free 1 Source: https://code.google.com/p/google-security-research/issues/detail?id=330&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=476926 Credit is to bilou,...

Adobe Flash - Drawing Methods this Use-After-Free

Adobe Flash - Drawing Methods this Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=388&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There are use-after frees realated to storing a single pointer this this pointer in several...

Adobe Flash - Pointer Crash After Continuing Slow Script

Adobe Flash - Pointer Crash After Continuing Slow Script Source: https://code.google.com/p/google-security-research/issues/detail?id=397&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Running the attached swf file in Google Chrome Linux x64 will eventually result in dialog...

Adobe Flash - scale9Grid Use-After-Free

Adobe Flash - scale9Grid Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=380&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a use-after-free issue if the scale9Grid setting is called on an object with a member that then...

Adobe Flash - XMLSocket Destructor Not Cleared Before Setting User Data in connect

Adobe Flash - XMLSocket Destructor Not Cleared Before Setting User Data in connect Source: https://code.google.com/p/google-security-research/issues/detail?id=416&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id This issue is a variant of issue 192 , which the fix did not...

Flash Broker-Based - Sandbox Escape via Timing Attack Against File Moving

Flash Broker-Based - Sandbox Escape via Timing Attack Against File Moving Source: https://code.google.com/p/google-security-research/issues/detail?id=280&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id FlashBroker - BrokerMoveFileEx TOCTOU IE PM Sandbox Escape 1. Windows 8....

Adobe Flash - Out-of-Bounds Memory Read While Parsing a Mutated .TTF File Embedded in SWF

Adobe Flash - Out-of-Bounds Memory Read While Parsing a Mutated .TTF File Embedded in SWF Source: https://code.google.com/p/google-security-research/issues/detail?id=363&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id The following access violation was observed in the Adobe...

Adobe Flash - Pointer Crash in Drawing and Bitmap Handling

Source: https://code.google.com/p/google-security-research/issues/detail?id=396&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id A nasty looking crash is manifesting in various different ways under fuzzing, apparently related to drawing and bitmap handling. A trigger is...

Adobe Flash - Pointer Crash After Continuing Slow Script

Source: https://code.google.com/p/google-security-research/issues/detail?id=397&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Running the attached swf file in Google Chrome Linux x64 will eventually result in dialog offering to terminate the slow script. Not the Google...

Adobe Flash - Pointer Crash in XML Handling

Source: https://code.google.com/p/google-security-research/issues/detail?id=400&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id The attached sample file, signalsigsegv7ffff637297a8900e3f87b25c25db8f9ec3c975f8c1211cc.swf, crashes, perhaps relating to XML handling. The crash...

Adobe Flash - '.SWF' Out-of-Bounds Memory Read (2)

Source: https://code.google.com/p/google-security-research/issues/detail?id=362&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id The following access violation was observed in the Adobe Flash Player plugin: 1dec.1af0: Access violation - code c0000005 first chance First chanc...

Adobe Flash - Heap Use-After-Free in SurfaceFilterList::C​reateFromScriptAtom

Source: https://code.google.com/p/google-security-research/issues/detail?id=484&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id Tracking for: https://code.google.com/p/chromium/issues/detail?id=508072 VULNERABILITY DETAILS Copy Paste of Issue 480496 VERSION Chrome Version:...

Adobe Flash - Out-of-Bounds Memory Read While Parsing a Mutated '.TTF' File Embedded in SWF

Source: https://code.google.com/p/google-security-research/issues/detail?id=363&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id The following access violation was observed in the Adobe Flash Player plugin: 1ba8.1c60: Access violation - code c0000005 first chance First chanc...