地图 / Use after free during the StageVideoAvailabilityEvent can result in arbitrary code execution

Use after free during the StageVideoAvailabilityEvent can result in arbitrary code execution

内存破坏 / 内存破坏（通用） / #47232

厂商: Internet Bug Bounty
严重程度: 未评级
赏金: —
弱点: 内存破坏（通用）
研究员: @biloulehibou
披露日期: 2015-03-25
资产: IBB (Legacy)
CVE: CVE-2015-0315

该报告还没有中文解读。

原文摘录

摘自原文（464 字符中的一小部分）

An attacker can register the StageVideoAvailabilityEvent and have the SWF movie reloaded at the same time with LoadMovie. During this process, an object may be freed allowing the attacker to take control of the code flow.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Internet Bug Bounty 所有。

时间线

2015-02-09报告提交
2015-03-25公开披露

阅读 HackerOne 原文 ↗作者 @biloulehibou · 版权归作者与 Internet Bug Bounty 所有

同类报告

Race Conditions in Popular reports feature.HackerOne · 2016-08-03 Malformed .MDL triggers an Access Violation on GoldSRC (hl.exe)Valve · 2019-10-09 [FG-VD-19-009] Intel(R) Trace Analyzer and Collector 2019 Memory Corruption Vulnerability NotificationIntel Corporation · — · $1,500 Type Confusion Vulnerability - SOAP / make_http_soap_request()Internet Bug Bounty · 2019-10-15 · $1,000 Corrupted pointer in node::fs::ReadFileUtf8(const FunctionCallbackInfo<Value>& args) when args[0] is a string.Node.js · 2025-05-15 Heap overflow in mysqlnd related to BIT fields (CVE-2016-7412)Internet Bug Bounty · 2019-11-12