Adobe Flash TextField.tabIndex Setter - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=574 There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField's parent, leading to a use-after-free. A minimal PoC follows: var...

Adobe Flash MovieClip.localToGlobal - Use-After-Free

Adobe Flash MovieClip.localToGlobal - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=570 There is a use-after-free issue in MovieClip.localToGlobal. If the Number constructor is overwritten with a new constructor and MovieClip.localToGlobal is called wi...

Adobe Flash TextField.setFormat - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=586 The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method ca...

Adobe Flash MovieClip.localToGlobal - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=570 There is a use-after-free issue in MovieClip.localToGlobal. If the Number constructor is overwritten with a new constructor and MovieClip.localToGlobal is called with an integer parameter, the new constructor will get...

Adobe Flash GradientFill - Use-After-Frees

Adobe Flash GradientFill - Use-After-Frees Source: https://code.google.com/p/google-security-research/issues/detail?id=557 There are a number of use-after-free vulnerabilities in MovieClip.beginGradientFill. If the spreadMethod or any other string parameter is an object with toString defined, thi...

Adobe Flash - Type Confusion in TextRenderer.setAdvancedAntialiasingTable

Source: https://code.google.com/p/google-security-research/issues/detail?id=409&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id There is a type confusion issue in TextRenderer.setAdvancedAntialiasingTable. If the font, insideCutoff or outsideCutoff are set to objects that a...

Code injection

Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows allow user-assisted remote attackers to execute arbitrary code via a crafted .FLA file...

CVE-2008-1201

Affected software: Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 running on Windows. Component: FLA file parser. Root cause: parsing malformed FLA files in the FLA parser can lead to arbitrary code execution. Impact: remote code execution with user-assisted exploitation; e...

CVE-2008-1201

Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows allow user-assisted remote attackers to execute arbitrary code via a crafted .FLA file...

[Full-disclosure] Adobe Flash CS3 Professional FLA File Parsing Multiple Local Code Execute Vulnerabilities

Adobe Flash CS3 Professional FLA File Parsing Multiple Local Code Execute Vulnerabilities by [email protected] http://ruder.cdut.net Summary: More than three local code execute vulnerabilities exist in Adobe Flash CS3 Professional while it is parsing FLA files. An attacker who...

CVE-2008-1201: Improper Control of Generation of Code

Multiple unspecified vulnerabilities in FLA file parsing in Adobe Flash CS3 Professional, Flash Professional 8, and Flash Basic 8 on Windows allow user-assisted remote attackers to execute arbitrary code via a crafted .FLA file...

Adobe Flash CS3 Professional FLA文件处理代码执行漏洞

BUGTRAQ ID: 28349 CVECAN ID: CVE-2008-1201 Adobe Flash CS3 Professional软件是用于为数码、Web和移动平台创建丰富的交互式内容的最高级创作环境。 Adobe Flash CS3 Professional处理畸形格式的.FLA文件时存在漏洞，攻击者可能利用此漏洞提升权限。 如果用户受骗使用Flash CS3 Professional打开了畸形的.FLA文件的话，就可能导致执行任意指令。 FLA是Flash Professional和Flash Basic的私有文件格式，Flash...