Adobe Flash - AVC Header Slicing Heap Overflow Exploit

🗓️ 15 Mar 2017 00:00:00Reported by Google Security ResearchType

zdt🔗 0day.today👁 33 Views

Adobe Flash AVC Header Slicing Heap Overflo

Reporter	Title	Published	Views	Family All 74
FreeBSD	flash -- multiple vulnerabilities	10 Jan 201700:00	–	freebsd
ALT Linux	Security fix for the ALT Linux 7 package adobe-flash-player version 3:24-alt0.M70P.2	12 Jan 201700:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 6 package adobe-flash-player version 3:24-alt0.M70P.2	12 Jan 201700:00	–	altlinux
Tenable Nessus	Flash Player < 24.0.0.194 Multiple Vulnerabilities (APSB17-02)	12 Jan 201700:00	–	nessus
Tenable Nessus	Adobe Flash Player <= 24.0.0.186 Multiple Vulnerabilities (APSB17-02)	10 Jan 201700:00	–	nessus
Tenable Nessus	FreeBSD : flash -- multiple vulnerabilities (2a7bdc56-d7a3-11e6-ae1b-002590263bf5)	11 Jan 201700:00	–	nessus
Tenable Nessus	GLSA-201702-20 : Adobe Flash Player: Multiple vulnerabilities	21 Feb 201700:00	–	nessus
Tenable Nessus	Adobe Flash Player for Mac <= 24.0.0.186 Multiple Vulnerabilities (APSB17-02)	10 Jan 201700:00	–	nessus
Tenable Nessus	openSUSE Security Update : flash-player (openSUSE-2017-71)	12 Jan 201700:00	–	nessus
Tenable Nessus	RHEL 6 : flash-plugin (RHSA-2017:0057)	12 Jan 201700:00	–	nessus

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1017
 
There is a heap overflow in AVC header slicing. To reproduce the issue, put the attached files on a server and visit http://127.0.0.1/LoadImage.swf?img=slice.flv
 
 
Proof of Concept:
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/41612.zip

#  0day.today [2018-01-02]  #

15 Mar 2017 00:00Current

0.4Low risk

Vulners AI Score0.4

EPSS0.69327