Issue metadata
Sign in to add a comment
|
Security: [FG-VD-16-076] Adobe Flash Player Handling ATF Heap Overflow Vulnerability
Reported by
kevinlu0...@gmail.com,
Nov 8 2016
|
||||||||||||||||||||
Issue descriptionVULNERABILITY DETAILS It is a heap overflow vulnerability in ATF processing. VERSION Adobe Flash Player 23.0.0.207 Other versions may be affected too REPRODUCTION CASE To reproduce the issue, put LoadImage.swf and FG-VD-16-076_PoC.atf on a server and load http://127.0.0.1:8080/LoadImage.swf?img=FG-VD-16-076_PoC.atf. run the following command line in cmd. flashplayer_23_sa_207.exe http://127.0.0.1:8080/LoadImage.swf?img=FG-VD-16-076_PoC.atf Credits: This vulnerability was discovered by Kai Lu of Fortinet's FortiGuard Labs.
,
Nov 9 2016
,
Nov 9 2016
Sorry, I'm having trouble getting this to crash. What browser and OS do these work on?
,
Nov 10 2016
I tested it with flash player standalone in windows 7,10.(enable page heap) and also tested it in IE11 in Windows 7(enable page heap). They works.
,
Nov 10 2016
still not test it in Chrome yet, I will test it right now.
,
Nov 12 2016
I'm still having trouble reproducing these, but I'm going to pass them to Adobe so they can investigate further. In the meantime, can you submit a sample that crashes in Chrome, as this is a Chrome rewards program?
,
Nov 15 2016
Ok,thanks. There are many crash samples for this case. I will try to find a sample that crashes in Chrome.
,
Nov 18 2016
Any update on triaging this? Thanks.
,
Nov 18 2016
Sorry, there isn't. I've reported it to Adobe, I'll let you know when I hear back.
,
Nov 30 2016
Adobe assigned this PSIRT-6013.
,
Jan 10 2017
This was fixed this update as CVE-2017-2927. It is ready for the Rewards Panel.
,
Jan 10 2017
,
Jan 11 2017
,
Feb 18 2017
,
Feb 18 2017
The panel decided to award $500 for this report.
,
Feb 18 2017
,
Feb 20 2017
,
Mar 31 2017
,
Apr 19 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||
Comment 1 by rickyz@chromium.org
, Nov 9 2016Labels: Security_Severity-High
Owner: natashenka@google.com
Status: Assigned (was: Unconfirmed)