Adobe Flash - MovieClip.duplicateMovieClip Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=759 There is a use-after-free in MovieClip.duplicateMovieClip.If an action associated with the MovieClip frees the clip provided as the initObject parameter to the call, it will be used after it is freed.A PoC is attached. Proof of...

Adobe Flash - MovieClip.duplicateMovieClip Use-After-Free

Adobe Flash - MovieClip.duplicateMovieClip Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=759 There is a use-after-free in MovieClip.duplicateMovieClip.If an action associated with the MovieClip frees the clip provided as the initObject parameter to the call, it...

Adobe Flash MovieClip.duplicateMovieClip - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=591 There is a use-after-free in MovieClip.duplicateMovieClip. If the depth or movie name parameter provided is an object with toString or valueOf defined, this method can free the MovieClip, which is then used. A minimal...