Issue metadata
Sign in to add a comment
|
Security: use-after-free vulnerability in flash player 22.0.0.192
Reported by
jiezengo...@gmail.com,
Jun 23 2016
|
|||||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS There is a use-after-free vulnerability in flash player. Which could lead to code execution. In chrome the crash as follow: 3:039> r eax=031b5b30 ebx=0309a348 ecx=0309a348 edx=00000000 esi=03201000 edi=00000000 eip=00000000 esp=00222d60 ebp=00222e18 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 00000000 ?? ??? ub esp: 5864fe0f 8bd9 mov ebx,ecx 5864fe11 33ff xor edi,edi 5864fe13 897c2428 mov dword ptr [esp+28h],edi 5864fe17 8b03 mov eax,dword ptr [ebx] 5864fe19 8b500c mov edx,dword ptr [eax+0Ch] 5864fe1c 8d8c24ac000000 lea ecx,[esp+0ACh] 5864fe23 51 push ecx 5864fe24 8bcb mov ecx,ebx 5864fe26 895c2428 mov dword ptr [esp+28h],ebx 5864fe2a 897c243c mov dword ptr [esp+3Ch],edi 5864fe2e ffd2 call edx dd ecx: 0309a348 031b5b30 00000000 00000000 00000000 0309a358 00000000 00000000 00000000 00000000 0309a368 00000000 00000000 00000000 00000000 0309a378 00000000 00000000 00000000 00000000 0309a388 00000000 00000000 00000000 00000000 so this vulnerability can control the EIP. VERSION Flash player 22.0.0.192 in Chrome windows 7 x86(other platform should be trigger also) Please drag the uaftest.swf into chrome will crash. Please not public in MAPP and public it in chrome issues list 14 weeks after being marked as Fixed. Credit is to "JieZeng of Tencent Zhanlu Lab". Please report is as soon as possible.
,
Jun 23 2016
+natashenka, can you please have a look?
,
Jun 23 2016
Thanks, I've reported it!
,
Jun 23 2016
This is PSIRT-5526.
,
Jun 23 2016
,
Jun 24 2016
@natashenka Thanks!
,
Jun 24 2016
,
Jun 24 2016
,
Jul 8 2016
natashenka: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers? If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one? If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Jul 10 2016
Please let me know the progress of this issue! Thanks!
,
Jul 11 2016
Adobe is still working on this issue, it will not be fixed in the next update, maybe in August instead.
,
Jul 12 2016
@natashenka Thanks! Let's keep in touch.
,
Jul 13 2016
,
Jul 13 2016
,
Jul 21 2016
Is it eligible for reward?
,
Jul 21 2016
,
Jul 21 2016
Once the fix is released the reward panel will take a look. I don't see any reason to think it wouldn't be, but it's up to the panel to decide.
,
Jul 22 2016
Thanks for letting me know.
,
Jul 26 2016
natashenka: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers? If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one? If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started. Thanks for your time! To disable nags, add the Disable-Nags label. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 11 2016
,
Sep 1 2016
,
Sep 22 2016
Fixed in September update
,
Sep 23 2016
,
Sep 25 2016
,
Sep 26 2016
Your change meets the bar and is auto-approved for M54 (branch: 2840)
,
Oct 7 2016
Nothing to merge here.
,
Oct 10 2016
,
Oct 11 2016
Very nice - $3,000 for this bug.
,
Oct 11 2016
,
Oct 12 2016
Thanks!then what do I need?
,
Nov 7 2016
,
Dec 30 2016
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
||||||||||||||||||||||||
►
Sign in to add a comment |
||||||||||||||||||||||||
Comment 1 by jiezengo...@gmail.com
, Jun 23 2016