Adobe Flash - ATF Image Packing Overflow

🗓️ 11 Jul 2016 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 63 Views

Heap overflow in Adobe Flash ATF Image Packin

Reporter	Title	Published	Views	Family All 61
FreeBSD	flash -- multiple vulnerabilities	16 Jun 201600:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt63	27 Jun 201600:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt63	27 Jun 201600:00	–	altlinux
Tenable Nessus	Flash Player < 11.2.202.626 / 18.0.0.360 / 22.0.0.192 Multiple Vulnerabilities	12 Jun 201600:00	–	nessus
Tenable Nessus	Adobe Flash Player <= 21.0.0.242 Multiple Vulnerabilities (APSB16-18)	17 Jun 201600:00	–	nessus
Tenable Nessus	FreeBSD : flash -- multiple vulnerabilities (0e3dfdde-35c4-11e6-8e82-002590263bf5)	20 Jun 201600:00	–	nessus
Tenable Nessus	Adobe Flash Player for Mac <= 21.0.0.242 Multiple Vulnerabilities (APSB16-18)	17 Jun 201600:00	–	nessus
Tenable Nessus	openSUSE Security Update : flash-player (openSUSE-2016-740)	20 Jun 201600:00	–	nessus
Tenable Nessus	openSUSE Security Update : flash-player (openSUSE-2016-743)	20 Jun 201600:00	–	nessus
Tenable Nessus	RHEL 6 : flash-plugin (RHSA-2016:1238)	20 Jun 201600:00	–	nessus

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=793
 
There is a heap overflow in ATF impage packing. To reproduce the issue, load the attach file '129' using LoadImage.swf as follows:
 
LoadImage.swf?img=129
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40090.zip

#  0day.today [2018-03-02]  #

11 Jul 2016 00:00Current

0.4Low risk

Vulners AI Score0.4

EPSS0.60707