Adobe Flash Sound.setTransform Use-After-Free
https://packetstormsecurity.com/files/136352/GS20160322234207.tgz
https://packetstormsecurity.com/files/136352/GS20160322234207.tgzhttps://packetstormsecurity.com/files/136352/Adobe-Flash-Sound.setTransform-Use-After-Free.htmlTue, 22 Mar 2016 23:42:07 GMTThere is a use-after-free in Sound.setTransform similar to the one described in CVE-2015-8434. If the transform object provided is an integer primitive, and the Number constructor is overwritten, this constructor will be executed and can free the internal sound transform, which is then written to.