Credit is to "Jihui Lu of KeenTeam (@K33nTeam), working with the Chromium vulnerability reward program"
Flash Player 16.0.0.296 in Chrome 40 Linux x64
I believe this is a use-after-free, due to quite varying crash stack trace depending on platform, etc. One example crash in the release build of Pepper Flash Player is:
=> 0x00007f471374f965: movl $0x1,0x60(%rdi)
rdi 0x7f471348bc10 139943242939408
7f4713206000-7f47141a0000 r-xp 00000000 fd:01 674828 /opt/google/chrome/PepperFlash/libpepflashplayer.so
TL;DR: this is an attempt to write to the executable text of the Flash library.
PoC.swf is attached. I expect it's a fuzz case; source not available.
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.
