793 - Adobe Flash: Overflow in ATF Image Packing - project-zero

Starred by 1 user

Status:	Fixed
Owner:	natashenka@google.com
Closed:	Jun 2016
Cc:	project-...@google.com
Finder-natashenka Deadline-90 CCProjectZeroMembers Product-Flash Severity-High Vendor-Adobe Finder-mjurczyk Reported-2016-Apr-1 Id-5089 Fixed-2016-Jun-16 CVE-2016-4138

Adobe Flash: Overflow in ATF Image Packing

Project Member Reported by natashenka@google.com, Apr 1 2016

Back to list

There is a heap overflow in ATF impage packing. To reproduce the issue, load the attach file '129' using LoadImage.swf as follows:

LoadImage.swf?img=129


This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.

LoadImage.swf
1.2 KB Download

129
353 bytes View Download

Project Member Comment 1 by natashenka@google.com, Apr 5 2016

Labels: Id-5089

Project Member Comment 2 by mjurczyk@google.com, Jun 17 2016

Labels: CVE-2016-4138 Fixed-2016-Jun-16
Status: Fixed

Fixed in https://helpx.adobe.com/security/products/flash-player/apsb16-18.html.

Project Member Comment 3 by natashenka@google.com, Jul 7 2016

Labels: -Restrict-View-Commit

► Sign in to add a comment