Adobe Flash (Multiple Scripts) - Use-After-Free When Rendering Displays (2)

Author: Google Security Research
type: dos
platform: windows
port: 
date_added: 2016-05-06 
date_updated: 2016-05-06 
verified: 1 
codes: CVE-2016-1013 
tags: 
aliases:  
screenshot_url:  
application_url: 

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=719

There is a use-after-free that appears to be related to rendering the display based on multiple scripts. A PoC is attached, tested on Windows only. Note the PoC is somewhat unreliable on some browsers, sometimes it needs to render a minute or two in the foreground before crashing. This is related to unreliability in the freed object being reallocated as a value that causes the crash, not unreliability in the underlying bug (it crashes immediately in a debug build of Flash). With enough effort, an attacker could likely trigger the issue immediately.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39778.zip