New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.
Issue 207
Starred by 1 user
Status: Fixed
Owner:
█ cevans@google.com
Email to this user bounced
Closed: Mar 2015
Cc:
█ lv.sam...@gmail.com
█ woo...@gmail.com
project-...@google.com



Sign in to add a comment
 Flash: use-after-free in display list handling from KeenTeam
Reported by cevans@google.com, Dec 3 2014 Back to list 
Credit is to "Jihui Lu of KeenTeam (@K33nTeam), working with the Chromium vulnerability reward program"

Flash player 15.0.0.239 in Chrome 39 Linux x64.

There is a use-after-free in display list handling. I attach a variety of repro cases, which I believe are all the same root cause based on crash stack traces.

The file "display_list_uaf6.swf" does seem to manifest differently and not be as reliable, so it is worth extra checking that any fix fixes this case.

This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
display_list_uaf5.swf
1.1 KB Download
display_list_uaf4.as
1.6 KB Download
display_list_uaf4.swf
1.1 KB Download
display_list_uaf3.swf
1.1 KB Download
display_list_uaf5.as
1.6 KB Download
display_list_uaf6.as
1.5 KB Download
display_list_uaf2.as
2.2 KB Download
display_list_uaf2.swf
1.2 KB Download
display_list_uaf6.swf
1.1 KB Download
display_list_uaf3.as
1.8 KB Download
Comment 1 by cevans@google.com, Dec 4 2014
Cc: woo...@gmail.com lv.sam...@gmail.com
Comment 2 by cevans@google.com, Dec 4 2014
Labels: Id-3170
Summary: Flash: use-after-free in display list handling from KeenTeam (was: Flash: use-after-free in display list handling from KEEN Team)
Adobe is tracking as PSIRT-3170.
Comment 3 by cevans@google.com, Feb 20 2015
Labels: Deadline-Grace Deadline-Exceeded
On Feb 17, Adobe formally requested to use the grace period for this bug under the new policy: http://googleprojectzero.blogspot.com/2015/02/feedback-and-data-driven-updates-to.html

Adobe stated that a patch will be available on March 10. The deadline expires on March 3, so March 10 is 7 days into the grace period, which is within the 14 day grace period limit.
Comment 4 by cevans@google.com, Mar 6 2015
Labels: CVE-2015-0342
Comment 6 by cevans@google.com, Mar 19 2015
Labels: -Restrict-View-Commit
Comment 7 by cevans@google.com, Mar 26 2015 
Chromium bug for reward tracking is https://code.google.com/p/chromium/issues/detail?id=464871
Comment 8 by cevans@google.com, Apr 10 2015
Labels: CVE-2015-0351
► Sign in to add a comment