header-logo
Suggest Exploit
vendor:
N/A
by:
Project Zero
7,5
CVSS
HIGH
Heap Corruption
119
CWE
Product Name: N/A
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2015

Heap Corruption due to LMZA Property Decoding

Loading the attached image causes heap corruption due to LMZA property decoding. To reproduce the issue, load the attach file '6' using LoadImage.swf as follows: LoadImage.swf?img=6. The issue sometimes takes multiple refreshes to crash.

Mitigation:

Ensure that all images are validated before loading them into memory.
Source

Exploit-DB raw data:

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=790

Loading the attached image causes heap corruption due to LMZA property decoding. To reproduce the issue, load the attach file '6' using LoadImage.swf as follows:

LoadImage.swf?img=6

The issue sometimes takes multiple refreshes to crash


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40089.zip

Navigation

Suggest Exploit

Services By CQR