Adobe Flash - Transform.colorTranform Getter Infomation Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=845 There is an info leak in the Transform.colorTranform getter. If the constructor for ColorTransform is overwritten with a getter using addProperty, this getter will execute when fetching the constructor, which can then free the...

Adobe Flash - Transform.colorTranform Getter Info Leak

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=845 There is an info leak in the Transform.colorTranform getter. If the constructor for ColorTransform is overwritten with a getter using addProperty, this getter will execute whe...

Adobe Flash - Transform.colorTranform Getter Infomation Leak

Adobe Flash - Transform.colorTranform Getter Infomation Leak Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=845 There is an info leak in the Transform.colorTranform getter. If the constructor for ColorTransform is overwritten with a getter using addProperty, this getter will...

Adobe Flash - Method Calls Use-After-Free

Adobe Flash - Method Calls Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846 If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a...

Adobe Flash - Method Calls Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846 If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a user-after-free. A minimal PoC is as follows: var mc ...

Mail.ru: Same origin policy bypass on e.mail.ru via Cross-Site Flashing

Hello Mail.Ru Security Team, There is a Cross-Site Flashing vulnerability in e.mail.ru. this vulnerability is similar to XSS except it is Flash script execution. Ref : https://www.owasp.org/index.php/TestingforCrosssiteflashingOTG-CLIENT-008 This allow an attacker to execute requests to the...

Two US State Election Systems Hacked to Steal Voter Databases — FBI Warns

A group of unknown hackers or an individual hacker may have breached voter registration databases for election systems in at least two US states, according to the FBI, who found evidence during an investigation this month. Although any intrusion in the state voting system has not been reported, t...

Adobe Flash - Selection.setFocus Use-After-Free

Adobe Flash - Selection.setFocus Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=841 There is a user-after-free in Selection.setFocus. It is a static method, but if it is called with a this object, it will be called on that object's thread. Then, if it calls into...

Adobe Flash - MovieClip Transform Getter Use-After-Free

Adobe Flash - MovieClip Transform Getter Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844 There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip...

Adobe Flash - BitmapData.copyPixels Use-After-Free

Adobe Flash - BitmapData.copyPixels Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843 There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert...

Adobe Flash - BitmapData.copyPixels Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843 There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert future parameters, even though it has already been...

Adobe Flash - Stage.align Setter Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free prevention changes. This conversion can invoke script,...

SUSE SLED12 Security Update : flash-player (SUSE-SU-2016:1613-1)

Adobe flash-player was updated to 11.2.202.626 to fix the following security issues : Security update to 11.2.202.626 boo984695 : - APSB16-18, CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132,...

Adobe Flash - Stage.align Setter Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free...

Adobe Flash - Stage.align Setter Use-After-Free

Adobe Flash - Stage.align Setter Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free preventi...

Adobe Flash - BitmapData.copyPixels Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843 There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert...

Adobe Flash - MovieClip Transform Getter Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844 There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip before it is accessed. A minimal PoC is as follows: var m...

Adobe Flash - Selection.setFocus Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=841 There is a user-after-free in Selection.setFocus. It is a static method, but if it is called with a this object, it will be called on that object's thread. Then, if it calls...

Adobe Flash - Use-After-Free When Returning Rectangle

Adobe Flash - Use-After-Free When Returning Rectangle Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=842 Several methods in flash return instances of the Rectangle class. There is a use-after-free in creating these objects for return. If the this object of the call is a...

Adobe Flash - Use-After-Free When Returning Rectangle

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=842 Several methods in flash return instances of the Rectangle class. There is a use-after-free in creating these objects for return. If the this object of the call is a MovieClip...