Adobe Flash – JXR Processing Double-Free

Exploit Database
145 阅读

作者： Google Security Research

日期： 2016-07-11
类别：
- dos
平台：
- multiple
来源：https://www.exploit-db.com/exploits/40088/

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=788

There is a heap overflow when loading the attacked JXR file in Adobe Flash. To reproduce, load the attached file using LoadImage.swf?img=12.atf.

This issue can be a bit difficult to reproduce, as the crash occurs when the player is destroyed, so the crash screen doesn't always show up on the Player. The easiest way to detect the issue is to attach a debugger to the Player and refresh a few times.

Took a closer look at this, it is a UaF of plane->model_hp_buffer in the open-source JXR component.

Proof of Concept:

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40088.zip

last Exploits
Adobe Flash – JXR Processing Double-Free的更多信息

Quick ‘n Easy FTP Server Lite 3.1 – Denial of Service：
Savy Soda Documents – Mobile Office Suite ‘.XLS’ Denial of Service：
Android Bluetooth – BNEP bnep_data_ind() Remote Heap Disclosure：
Wireshark 1.12.0 < 1.12.12 / 2.0.0 < 2.0.4 - PacketBB Dissector Denial of Service：
Microsoft DirectWrite / AFDKO – Use of Uninitialized Memory While Freeing Resources in var_loadavar：
iOS My DBLite Edition – Remote Denial of Service：
TapinRadio 2.12.3 – ‘username’ Denial of Service (PoC)：
Adobe Flash – JXR Processing Out-of-Bounds Read：