Adobe Flash BlurFilter Processing - Out-of-Bounds Memset

🗓️ 11 Jan 2016 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 36 Views

Adobe Flash BlurFilter Out-of-Bounds Memset issu

Reporter	Title	Published	Views	Family All 54
ALT Linux	Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt58	29 Dec 201500:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt58	29 Dec 201500:00	–	altlinux
FreeBSD	flash -- multiple vulnerabilities	28 Dec 201500:00	–	freebsd
Tenable Nessus	Flash Player < 20.0.0.267 Multiple Vulnerabilities (APSB16-01)	8 Jan 201600:00	–	nessus
Tenable Nessus	Adobe AIR < 20.0.0.233 Multiple Vulnerabilities (APSB16-01)	8 Jan 201600:00	–	nessus
Tenable Nessus	Adobe AIR <= 20.0.0.204 Multiple Vulnerabilities (APSB16-01)	29 Dec 201500:00	–	nessus
Tenable Nessus	Adobe Flash Player <= 20.0.0.235 Multiple Vulnerabilities (APSB16-01)	29 Dec 201500:00	–	nessus
Tenable Nessus	FreeBSD : flash -- multiple vulnerabilities (84c7ea88-bf04-4bdc-973b-36744bf540ab)	30 Dec 201500:00	–	nessus
Tenable Nessus	GLSA-201601-03 : Adobe Flash Player: Multiple vulnerabilities	27 Jan 201600:00	–	nessus
Tenable Nessus	Adobe AIR for Mac <= 20.0.0.204 Multiple Vulnerabilities (APSB16-01)	29 Dec 201500:00	–	nessus

Source: https://code.google.com/p/google-security-research/issues/detail?id=627
 
The attached swf file causes an out-of-bounds memset in BlurFilter processing. Note that Chrome aborts when processing the swf
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39219.zip

#  0day.today [2018-03-19]  #

11 Jan 2016 00:00Current

9.2High risk

Vulners AI Score9.2

EPSS0.39622