Adobe Flash GradientFill Use-After-Free
Posted by deepcore on December 18, 2015 – 9:47 pm
There are a number of use-after-free vulnerabilities in MovieClip.beginGradientFill. If the spreadMethod or any other string parameter is an object with toString defined, this method can free the MovieClip, which is then used. Note that many parameters to this function can be used to execute script and free the MovieClip during execution, it is recommended that this issues be fixed with a stale pointer check.
Post a reply
You must be logged in to post a comment.