A Tale of Two Exploits
Project Zero's Natalie Silvanovich reported CVE-2015-0336, a type confusion bug in Flash's ActionScript 2 NetConnection class caused by a faulty type check that lets a native function object pass as a NetConnection. Adobe patched it in March 2015, and less...