Adobe Flash TextField Variable - Use-After Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=583 If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's...

Adobe Flash TextField.sharpness Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=588 There is a use-after-free in the TextField sharpness setter. If the sharpness parameter is an object with valueOf set to a function which frees the TextField parent, ...

Adobe Flash TextField.Variable Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=579 There is a use-after-free in the TextField.variable setter. If the variable name that is added is an object with toString defined, the toString function can free the...

Adobe Flash TextField.text Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=576 There is a use-after-free in the TextField.text setter. If the text the field is set to is an object with toString defined, the toString function can free the field's...

Adobe Flash TextField.replaceText - Use-After-Free

Adobe Flash TextField.replaceText - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=584 There is a use-after-free in the TextField.replaceText function. If the function is called with a string parameter with toString defined, or an integer parameter with...

Adobe Flash - TextField Use-After Free

Adobe Flash - TextField Use-After Free Source: https://code.google.com/p/google-security-research/issues/detail?id=583 If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A...

Adobe Flash TextField.setFormat - Use-After-Free

Adobe Flash TextField.setFormat - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=586 The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method can...

Adobe Flash TextField.thickness Setter - Use-After-Free

Adobe Flash TextField.thickness Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=587 There is a use-after-free in the TextField thickness setter. If the thickness parameter is an object with valueOf set to a function which frees the TextField...

Adobe Flash TextField.text Setter - Use-After-Free

Adobe Flash TextField.text Setter - Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=576 There is a use-after-free in the TextField.text setter. If the text the field is set to is an object with toString defined, the toString function can free the field's...

Adobe Flash TextField.tabIndex Setter - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=574 There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField's parent, leading to a use-after-free. A minimal PoC follows: var...

Adobe Flash - 'TextField' Use-After Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=583 If a TextField variable is set to a value with toString defined, and the TextField is updated, a use-after-free can occur if the toString method frees the TextField's parent. A minimal PoC is as follows: var mc =...

Adobe Flash TextField.setFormat - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=586 The TextField setFormat method contains a use-after-free. If an integer parameter has valueOf defined, or the object parameter overrides a constructor, this method can free the TextField parent, which is subsequently...

Adobe Flash TextField.htmlText Setter - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=578 There is a use-after-free in the TextField.htmlText setter. If the htmlText the field is set to is an object with toString defined, the toString function can free the field's parent object, which is then used. A minim...

Adobe Flash - TextField.Variable Setter Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=579 There is a use-after-free in the TextField.variable setter. If the variable name that is added is an object with toString defined, the toString function can free the field's parent object, which is then used. A minima...

Adobe Flash TextField.replaceText - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=584 There is a use-after-free in the TextField.replaceText function. If the function is called with a string parameter with toString defined, or an integer parameter with valueOf defined, the parent object of the TextFiel...

Adobe Flash TextField.type Setter - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=577 There is a use-after-free in the TextField.type setter. If the type the field is set to is an object with toString defined, the toString function can free the field's parent object, which is then used. A minimal PoC i...

Adobe Flash TextField.thickness Setter - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=587 There is a use-after-free in the TextField thickness setter. If the thickness parameter is an object with valueOf set to a function which frees the TextField parent, it is used after it is freed. A minimal PoC is as...

Adobe Flash TextField.sharpness Setter - Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=588 There is a use-after-free in the TextField sharpness setter. If the sharpness parameter is an object with valueOf set to a function which frees the TextField parent, it is used after it is freed. A minimal PoC is as...

Adobe Flash TextField.tabIndex Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=574 There is a use-after-free in the TextField.tabIndex setter. If the integer parameter is an object with valueOf defined, then it can free the TextField's parent, leadi...

Adobe Flash TextField.antiAliasType Setter - Use-After-Free

Exploit for windows platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=560 There is a use-after-free in the TextField antiAliasType setter. If it is set to an object with a toString method that frees the TextField, the property will be writt...