Adobe Flash - BitmapData.copyPixels Use-After-Free

Adobe Flash - BitmapData.copyPixels Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843 There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert...

Adobe Flash - MovieClip Transform Getter Use-After-Free

Adobe Flash - MovieClip Transform Getter Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844 There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip...

Adobe Flash - BitmapData.copyPixels Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843 There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert future parameters, even though it has already been...

Adobe Flash - Stage.align Setter Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free prevention changes. This conversion can invoke script,...

Adobe Flash - Selection.setFocus Use-After-Free

Adobe Flash - Selection.setFocus Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=841 There is a user-after-free in Selection.setFocus. It is a static method, but if it is called with a this object, it will be called on that object's thread. Then, if it calls into...

SUSE SLED12 Security Update : flash-player (SUSE-SU-2016:1613-1)

Adobe flash-player was updated to 11.2.202.626 to fix the following security issues : Security update to 11.2.202.626 boo984695 : - APSB16-18, CVE-2016-4122, CVE-2016-4123, CVE-2016-4124, CVE-2016-4125, CVE-2016-4127, CVE-2016-4128, CVE-2016-4129, CVE-2016-4130, CVE-2016-4131, CVE-2016-4132,...

Adobe Flash - Stage.align Setter Use-After-Free

Adobe Flash - Stage.align Setter Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free preventi...

Adobe Flash - Stage.align Setter Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free...

Adobe Flash - BitmapData.copyPixels Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843 There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert...

Adobe Flash - MovieClip Transform Getter Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844 There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip before it is accessed. A minimal PoC is as follows: var m...

Adobe Flash - Use-After-Free When Returning Rectangle

Adobe Flash - Use-After-Free When Returning Rectangle Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=842 Several methods in flash return instances of the Rectangle class. There is a use-after-free in creating these objects for return. If the this object of the call is a...

Adobe Flash - MovieClip Transform Getter Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844 There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip befor...

Adobe Flash - Use-After-Free When Returning Rectangle

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=842 Several methods in flash return instances of the Rectangle class. There is a use-after-free in creating these objects for return. If the this object of the call is a MovieClip...

Adobe Flash - Selection.setFocus Use-After-Free

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=841 There is a user-after-free in Selection.setFocus. It is a static method, but if it is called with a this object, it will be called on that object's thread. Then, if it calls...

Adobe Flash - Use-After-Free When Returning Rectangle

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=842 Several methods in flash return instances of the Rectangle class. There is a use-after-free in creating these objects for return. If the this object of the call is a MovieClip, the Rectangle instantiation will run on its thread...

Adobe Flash - Selection.setFocus Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=841 There is a user-after-free in Selection.setFocus. It is a static method, but if it is called with a this object, it will be called on that object's thread. Then, if it calls into script, for example, by calling toString on the...

Phoenix Exploit Kit - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Phoenix Exploit Kit Remote Code Execution', 'Description' = %q This module exploits a Remote Code Execution in the web panel of...

Phoenix Exploit Kit Remote Code Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Phoenix Exploit Kit Remote Code Execution', 'Description' = %q This module exploits a Remote Code Execution in the web panel of...

Adobe Patches Experience Manager; No Flash Update

Adobe rolled out its monthly patch release today, and the news isn’t necessarily what was patched, but what wasn’t. For the first time since January, Adobe did not release a security update for Flash Player. Given Flash’s legacy of being a target-rich environment for cybercriminals and advanced...

Adobe Flash Player Security Bypass (APSB16-18: CVE-2016-4139)

When calling window location toString or comparing window location toString is called an attacker can return arbitrary values. An attacker can make the applet believe that it is embedded inside the hosting page, by overriding window location toString. Hence, an attacker can call any method that i...