Metasploit modules that can be used to exploit Adobe » Flash Player » 8.0.39.0

Order by Disclosure Date Module Name Module Type
  • Adobe Flash Player DeleteRangeTimelineOperation Type-Confusion
    Disclosure Date: 2016-04-27
    First seen: 2020-04-26
    exploit/osx/browser/adobe_flash_delete_range_tl_op
    This module exploits a type confusion on Adobe Flash Player, which was originally found being successfully exploited in the wild. This module has been tested successfully on: macOS Sierra 10.12.3, Safari and Adobe Flash Player 21.0.0.182, Firefox and Adobe Flash Player 21.0.0.182. Authors: - Genwei Jiang - bcook-r7
  • Adobe Flash Player ByteArray Use After Free
    Disclosure Date: 2015-07-06
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_hacking_team_uaf
    This module exploits an use after free on Adobe Flash Player. The vulnerability, discovered by Hacking Team and made public as part of the July 2015 data leak, was described as an Use After Free while handling ByteArray objects. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.194, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.194, Windows 8.1 (32-bit), IE11 and Adobe Flash 18.0.0.194, Windows 8.1 (32-bit), Firefox and Adobe Flash 18.0.0.194, and Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.468. Authors: - Unknown - juan vazquez <juan.vazquez@metasploit.com> - sinn3r <sinn3r@metasploit.com>
  • Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow
    Disclosure Date: 2015-06-23
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_nellymoser_bof
    This module exploits a buffer overflow on Adobe Flash Player when handling nellymoser encoded audio inside a FLV video, as exploited in the wild on June 2015. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.160, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.160, Windows 8.1, Firefox 38.0.5 and Adobe Flash 18.0.0.160, Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.466, and Ubuntu 14.04.2 LTS, Firefox 35.01, and Adobe Flash 11.2.202.466. Note that this exploit is effective against both CVE-2015-3113 and the earlier CVE-2015-3043, since CVE-2015-3113 is effectively a regression to the same root cause as CVE-2015-3043. Authors: - Unknown - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player Nellymoser Audio Decoding Buffer Overflow
    Disclosure Date: 2015-06-23
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_nellymoser_bof
    This module exploits a buffer overflow on Adobe Flash Player when handling nellymoser encoded audio inside a FLV video, as exploited in the wild on June 2015. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 18.0.0.160, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 18.0.0.160, Windows 8.1, Firefox 38.0.5 and Adobe Flash 18.0.0.160, Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.466, and Ubuntu 14.04.2 LTS, Firefox 35.01, and Adobe Flash 11.2.202.466. Note that this exploit is effective against both CVE-2015-3113 and the earlier CVE-2015-3043, since CVE-2015-3113 is effectively a regression to the same root cause as CVE-2015-3043. Authors: - Unknown - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player Drawing Fill Shader Memory Corruption
    Disclosure Date: 2015-05-12
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_shader_drawing_fill
    This module exploits a memory corruption happening when applying a Shader as a drawing fill as exploited in the wild on June 2015. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 17.0.0.188, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 17.0.0.188, Windows 8.1, Firefox 38.0.5 and Adobe Flash 17.0.0.188, and Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.460. Authors: - Chris Evans - Unknown - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player ShaderJob Buffer Overflow
    Disclosure Date: 2015-05-12
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_shader_job_overflow
    This module exploits a buffer overflow vulnerability related to the ShaderJob workings on Adobe Flash Player. The vulnerability happens when trying to apply a Shader setting up the same Bitmap object as src and destination of the ShaderJob. Modifying the "width" attribute of the ShaderJob after starting the job it's possible to create a buffer overflow condition where the size of the destination buffer and the length of the copy are controlled. This module has been tested successfully on: Windows 7 SP1 (32-bit), IE11 and Adobe Flash 17.0.0.169, Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 17.0.0.169, Windows 8.1, Firefox 38.0.5 and Adobe Flash 17.0.0.169, and Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.457. Authors: - Chris Evans - Unknown - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player NetConnection Type Confusion
    Disclosure Date: 2015-03-12
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_net_connection_confusion
    This module exploits a type confusion vulnerability in the NetConnection class on Adobe Flash Player. When using a correct memory layout this vulnerability allows to corrupt arbitrary memory. It can be used to overwrite dangerous objects, like vectors, and ultimately accomplish remote code execution. This module has been tested successfully on: * Windows 7 SP1 (32-bit), IE 8, IE11 and Adobe Flash 16.0.0.305. * Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 16.0.0.305. * Windows 8.1, Firefox 38.0.5 and Adobe Flash 16.0.0.305. * Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Adobe Flash 11.2.202.424. * Ubuntu 14.04.2 LTS, Firefox 33.0 and Adobe Flash 11.2.202.442. Authors: - Natalie Silvanovich - Unknown - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player ByteArray With Workers Use After Free
    Disclosure Date: 2015-02-02
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_worker_byte_array_uaf
    This module exploits a use-after-free vulnerability in Adobe Flash Player. The vulnerability occurs when the ByteArray assigned to the current ApplicationDomain is freed from an ActionScript worker, which can fill the memory and notify the main thread to corrupt the new contents. This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 to IE 11 and Flash 16.0.0.296. Authors: - Unknown - hdarwin - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player PCRE Regex Vulnerability
    Disclosure Date: 2014-11-25
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_pcre
    This module exploits a vulnerability found in Adobe Flash Player. A compilation logic error in the PCRE engine, specifically in the handling of the \c escape sequence when followed by a multi-byte UTF8 character, allows arbitrary execution of PCRE bytecode. Authors: - Mark Brand - sinn3r <sinn3r@metasploit.com>
  • Adobe Flash Player casi32 Integer Overflow
    Disclosure Date: 2014-10-14
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_casi32_int_overflow
    This module exploits an integer overflow in Adobe Flash Player. The vulnerability occurs in the casi32 method, where an integer overflow occurs if a ByteArray of length 0 is setup as domainMemory for the current application domain. This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 to IE 11 and Flash 15.0.0.167. Authors: - bilou - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player copyPixelsToByteArray Method Integer Overflow
    Disclosure Date: 2014-09-23
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_copy_pixels_to_byte_array
    This module exploits an integer overflow in Adobe Flash Player. The vulnerability occurs in the copyPixelsToByteArray method from the BitmapData object. The position field of the destination ByteArray can be used to cause an integer overflow and write contents out of the ByteArray buffer. This module has been tested successfully on: * Windows 7 SP1 (32-bit), IE 8 to IE 11 and Flash 14.0.0.176, 14.0.0.145, and 14.0.0.125. * Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 14.0.0.179. * Windows 8.1, Firefox 38.0.5 and Adobe Flash 14.0.0.179. Authors: - Chris Evans - Nicolas Joly - hdarwin - juan vazquez <juan.vazquez@metasploit.com>
  • Flash "Rosetta" JSONP GET/POST Response Disclosure
    Disclosure Date: 2014-07-08
    First seen: 2020-04-26
    auxiliary/gather/flash_rosetta_jsonp_url_disclosure
    A website that serves a JSONP endpoint that accepts a custom alphanumeric callback of 1200 chars can be abused to serve an encoded swf payload that steals the contents of a same-domain URL. Flash < 14.0.0.145 is required. This module spins up a web server that, upon navigation from a user, attempts to abuse the specified JSONP endpoint URLs by stealing the response from GET requests to STEAL_URLS. Authors: - Michele Spagnuolo - joev <joev@metasploit.com>
  • Adobe Flash Player ByteArray UncompressViaZlibVariant Use After Free
    Disclosure Date: 2014-04-28
    First seen: 2020-04-26
    exploit/multi/browser/adobe_flash_uncompress_zlib_uaf
    This module exploits a use after free vulnerability in Adobe Flash Player. The vulnerability occurs in the ByteArray::UncompressViaZlibVariant method, when trying to uncompress() a malformed byte stream. This module has been tested successfully on: * Windows 7 SP1 (32 bits), IE 8 to IE 11 and Flash 16.0.0.287, 16.0.0.257 and 16.0.0.235. * Windows 7 SP1 (32-bit), Firefox 38.0.5 and Adobe Flash 16.0.0.287. * Windows 8.1, Firefox 38.0.5 and Adobe Flash 16.0.0.305. * Linux Mint "Rebecca" (32 bits), Firefox 33.0 and Flash 11.2.202.424. Authors: - Unknown - hdarwin - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player domainMemory ByteArray Use After Free
    Disclosure Date: 2014-04-14
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_domain_memory_uaf
    This module exploits a use-after-free vulnerability in Adobe Flash Player. The vulnerability occurs when the ByteArray assigned to the current ApplicationDomain is freed from an ActionScript worker, when forcing a reallocation by copying more contents than the original capacity, but Flash forgets to update the domainMemory pointer, leading to a use-after-free situation when the main worker references the domainMemory again. This module has been tested successfully on Windows 7 SP1 (32-bit), IE 8 and IE11 with Flash 17.0.0.134. Authors: - bilou - Unknown - hdarwin - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player 11.3 Kern Table Parsing Integer Overflow
    Disclosure Date: 2012-08-09
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_otf_font
    This module exploits a vulnerability found in the ActiveX component of Adobe Flash Player before 11.3.300.271. By supplying a specially crafted .otf font file with a large nTables value in the 'kern' header, it is possible to trigger an integer overflow, which results in remote code execution under the context of the user. This vulnerability has also been exploited in the wild in limited targeted attacks. Please note in order to ensure reliability, the exploit is forced to modify your URIPATH parameter to less than 3 characters, which may cause possible URIPATH collisions. Authors: - Alexander Gavrun - sinn3r <sinn3r@metasploit.com> - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player AVM Verification Logic Array Indexing Code Execution
    Disclosure Date: 2012-06-21
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flashplayer_arrayindexing
    This module exploits a vulnerability in Adobe Flash Player versions 10.3.181.23 and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same vulnerability that was used for attacks against Korean based organizations. Specifically, this issue occurs when indexing an array using an arbitrary value, memory can be referenced and later executed. Taking advantage of this issue does not rely on heap spraying as the vulnerability can also be used for information leakage. Currently this exploit works for IE6, IE7, IE8, Firefox 10.2 and likely several other browsers under multiple Windows platforms. This exploit bypasses ASLR/DEP and is very reliable. Authors: - mr_me <steventhomasseeley@gmail.com> - Unknown
  • Adobe Flash Player MP4 'cprt' Overflow
    Disclosure Date: 2012-02-15
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_mp4_cprt
    This module exploits a vulnerability found in Adobe Flash Player. By supplying a corrupt .mp4 file loaded by Flash, it is possible to gain arbitrary remote code execution under the context of the user. This vulnerability has been exploited in the wild as part of the "Iran's Oil and Nuclear Situation.doc" e-mail attack. According to the advisory, 10.3.183.15 and 11.x before 11.1.102.62 are affected. Authors: - Alexander Gavrun - sinn3r <sinn3r@metasploit.com> - juan vazquez <juan.vazquez@metasploit.com>
  • Adobe Flash Player MP4 SequenceParameterSetNALUnit Buffer Overflow
    Disclosure Date: 2011-08-09
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flash_sps
    This module exploits a vulnerability found in Adobe Flash Player's Flash10u.ocx component. When processing a MP4 file (specifically the Sequence Parameter Set), Flash will see if pic_order_cnt_type is equal to 1, which sets the num_ref_frames_in_pic_order_cnt_cycle field, and then blindly copies data in offset_for_ref_frame on the stack, which allows arbitrary remote code execution under the context of the user. Numerous reports also indicate that this vulnerability has been exploited in the wild. Authors: - Alexander Gavrun - Unknown - sinn3r <sinn3r@metasploit.com>
  • Adobe Flash Player 10.2.153.1 SWF Memory Corruption Vulnerability
    Disclosure Date: 2011-04-11
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flashplayer_flash10o
    This module exploits a vulnerability in Adobe Flash Player that was discovered, and has been exploited actively in the wild. By embedding a specially crafted .swf file, Adobe Flash crashes due to an invalid use of an object type, which allows attackers to overwrite a pointer in memory, and results arbitrary code execution. Please note for IE 8 targets, Java Runtime Environment must be available on the victim machine in order to work properly. Authors: - sinn3r <sinn3r@metasploit.com>
  • Adobe Flash Player AVM Bytecode Verification Vulnerability
    Disclosure Date: 2011-03-15
    First seen: 2020-04-26
    exploit/windows/browser/adobe_flashplayer_avm
    This module exploits a vulnerability in Adobe Flash Player versions 10.2.152.33 and earlier. This issue is caused by a failure in the ActionScript3 AVM2 verification logic. This results in unsafe JIT(Just-In-Time) code being executed. This is the same vulnerability that was used for the RSA attack in March 2011. Specifically, this issue results in uninitialized memory being referenced and later executed. Taking advantage of this issue relies on heap spraying and controlling the uninitialized memory. Currently this exploit works for IE6, IE7, and Firefox 3.6 and likely several other browsers. DEP does catch the exploit and causes it to fail. Due to the nature of the uninitialized memory its fairly difficult to get around this restriction. Authors: - bannedit <bannedit@metasploit.com> - Unknown
23 metasploit modules found
1 2
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close