Adobe Flash – MovieClip.duplicateMovieClip Use-After-Free

• Exploit Database
• 56 阅读

• 作者： Google Security Research
  日期： 2016-05-06
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/39779/

• Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=759
  
  There is a use-after-free in MovieClip.duplicateMovieClip.If an action associated with the MovieClip frees the clip provided as the initObject parameter to the call, it will be used after it is freed.A PoC is attached.
  
  
  Proof of Concept:
  https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39779.zip