Internet Bug Bounty · Report #119653

Adobe Flash Player ASnative(900,1).call(MovieClip) Use-After-Free Vulnerability

Validstatus

$2,000bounty

1upvotes

12 Nov 2019disclosed

How it was found

I. Summary Adobe Flash Player is prone to a vulnerability which leads to Use-After-Free.

II. Description If the ASnative(900,1) is invoked with MovieClip instance and getter properties associated with swfRoot where the getter method includes a call to removeMovieClip(), the MovieClip instance is used after it is freed.

Latest version of Adobe Flash Player 20.0.0.267 has been tested under Windows 7.

III. Impact Use-After-Free

IV. Credit Wen Guanxing from Venustech ADLAB is credited for this vulnerability.

It has been assigned by Adobe as CVE-2016-0982 https://helpx.adobe.com/security/products/flash-player/apsb16-04.html

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original