349 - Flash: use-after-free in display list handling from KEEN Team, round 2 - project-zero

Starred by 2 users

Status:	Fixed
Owner:	█ cevans@google.com Email to this user bounced
Closed:	Jul 2015
Cc:	█ lv.sam...@gmail.com █ woo...@gmail.com project-...@google.com
Deadline-90 Finder-external Finder-keen Fixed-2015-Jul-8 Id-3621 Reported-2015-Apr-24 CVE-2015-3124 CCProjectZeroMembers Product-Flash Severity-High Vendor-Adobe

Flash: use-after-free in display list handling from KEEN Team, round 2

Reported by cevans@google.com, Apr 25 2015

Back to list

Credit is to KEEN Team.

3 different PoC's in the attached zip.

Filing as one bug for now; if Adobe say it's multiple different bugs, we'll treat it as such.


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

UAF2.zip
8.6 KB Download

Comment 1 by cevans@google.com, Apr 25 2015

Chromium tracking is https://code.google.com/p/chromium/issues/detail?id=481306

Comment 2 by cevans@google.com, Apr 27 2015

Labels: Id-3621

Comment 3 by woo...@gmail.com, May 13 2015

this one is credit to jihui lu of keenteam.

Comment 4 by cevans@google.com, Jul 5 2015

Labels: CVE-2015-3124

Comment 5 by cevans@google.com, Jul 9 2015

Labels: Fixed-2015-Jul-8
Status: Fixed

Fixed: https://helpx.adobe.com/security/products/flash-player/apsb15-16.html

Project Member Comment 6 by natashenka@google.com, Aug 18 2015

Labels: -Restrict-View-Commit

► Sign in to add a comment