Adobe Flash - ATF Processing Overflow

🗓️ 11 Jul 2016 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 43 Views

Flash ATF Processing Overflow causing heap overflow in ATF processing while decompressing alphas with 1 pixel heigh

Reporter	Title	Published	Views	Family All 60
FreeBSD	flash -- multiple vulnerabilities	16 Jun 201600:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt63	27 Jun 201600:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt63	27 Jun 201600:00	–	altlinux
ArchLinux	flashplugin: multiple issues	19 Jun 201600:00	–	archlinux
ArchLinux	lib32-flashplugin: multiple issues	20 Jun 201600:00	–	archlinux
BDU FSTEC	Vulnerability of software platforms such as Flash Player and Flash Player for Linux, which allows attackers to compromise the integrity, accessibility, and confidentiality of information.	11 Jul 201600:00	–	bdu_fstec
Circl	CVE-2016-4135	11 Jul 201600:00	–	circl
CNVD	Unspecified Heap Overflow Vulnerability in Microsoft Internet Explorer and Microsoft Edge Adobe Flash Player	19 Jun 201600:00	–	cnvd
Check Point Advisories	Adobe Flash Player Heap Overflow (APSB16-18: CVE-2016-4135)	13 Jun 201600:00	–	checkpoint_advisories
CVE	CVE-2016-4135	16 Jun 201614:00	–	cve

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=786
 
The attached ATF file causes a heap overflow in ATF processing. To reproduce this issue, put LoadImage.swf and test.png on a remote server, and visit http://127.0.0.1/LoadImage.swf?img=test.png.
 
To differentiate this from other ATF issues, this is an overflow in decompressing alphas when an image has a height of 1 pixel. 
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40087.zip

#  0day.today [2018-03-20]  #

11 Jul 2016 00:00Current

9.2High risk

Vulners AI Score9.2

EPSS0.30323