VulnCheck KEV: CVE-2016-7892

Adobe Flash Player has an exploitable use-after-free vulnerability in the TextField class...

Adobe Flash TextField Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

Memory Misreference Vulnerability in Multiple Adobe Products (CNVD-2016-02717)

Adobe Flash Player, Adobe AIR SDK, and Adobe AIR SDK & Compiler are products of Adobe, Incorporated.Adobe Flash Player is a multimedia player; Adobe AIR SDK and Adobe AIR SDK & Compiler are standard development kits for Adobe AIR a cross-OS runtime environment. Adobe Flash Player is a multimedia...

CVE-2015-8823

Use-after-free vulnerability in the TextField object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before...

Adobe Flash TextField text Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Flash. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the TextField object...

Adobe Flash - Color.setTransform Use-After-Free

Adobe Flash - Color.setTransform Use-After-Free Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451 If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows: var tf:TextField = this.createTextField"tf",1,1,1,4,4 var n ...

Adobe Flash - textfield.maxChars Use-After-Free

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=581 There is a use-after-free in the TextField.maxChars setter. If the maxChars the field is set to is an object with valueOf defined, the valueOf function can free the field's parent object, which is then used. A minimal PoC is as...

Adobe AIR < 20.0.0.260 Multiple Vulnerabilities (APSB16-04)

Binary data 9154.prm...

Internet Bug Bounty: Adobe Flash Player ASnative(900,1).call(TextField) Use-After-Free Vulnerability

I. Summary Adobe Flash Player is prone to a vulnerability which leads to Use-After-Free. ------------------------------------------------------------------ II. Description If the ASnative900,1 is invoked with TextField instance and getter properties associated with swfRoot where the getter method...

Adobe Flash - textfield Constructor Type Confusion

Adobe Flash - textfield Constructor Type Confusion Source: https://code.google.com/p/google-security-research/issues/detail?id=701 There is a type confusion vulnerability in the TextField constructor in AS3. When a TextField is constructed, a generic backing object is created and reused when...

Adobe Flash - textfield Constructor Type Confusion

Source: https://code.google.com/p/google-security-research/issues/detail?id=701 There is a type confusion vulnerability in the TextField constructor in AS3. When a TextField is constructed, a generic backing object is created and reused when subsequent TextField objects are created. However, if a...

Adobe Flash - textfield Constructor Type Confusion

Exploit for multiple platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=701 There is a type confusion vulnerability in the TextField constructor in AS3. When a TextField is constructed, a generic backing object is created and reused when...

The vulnerability of the Flash Player and Adobe Integrated Runtime software allows a perpetrator to execute arbitrary code.

The vulnerability of the TextField object implementation in Flash Player and Adobe Integrated Runtime relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted value for the autoSize property...

The vulnerability of the Flash Player and Adobe Integrated Runtime software allows a perpetrator to execute arbitrary code.

The vulnerability of the Flash Player and Adobe Integrated Runtime programming platforms is related to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted value filter in the TextField object...

Adobe Flash - TextField.Variable Setter Use-After-Free

Adobe Flash - TextField.Variable Setter Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=579 There is a use-after-free in the TextField.variable setter. If the variable name that is added is an object with toString defined, the toString function can free...

Adobe Flash TextField.sharpness Setter - Use-After-Free

Adobe Flash TextField.sharpness Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=588 There is a use-after-free in the TextField sharpness setter. If the sharpness parameter is an object with valueOf set to a function which frees the TextField...

Adobe Flash TextField.type Setter - Use-After-Free

Adobe Flash TextField.type Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=577 There is a use-after-free in the TextField.type setter. If the type the field is set to is an object with toString defined, the toString function can free the field's...

Adobe Flash TextField.thickness Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=587 There is a use-after-free in the TextField thickness setter. If the thickness parameter is an object with valueOf set to a function which frees the TextField parent, ...

Adobe Flash TextField.setFormat - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=586 The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method ca...

Adobe Flash TextField.type Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=577 There is a use-after-free in the TextField.type setter. If the type the field is set to is an object with toString defined, the toString function can free the field's...