systemd/fuzz-dhcp6-client: Heap-buffer-overflow in dhcp6_option_parse_status

Detailed report: https://oss-fuzz.com/testcase?key=5719574129934336 Project: systemd Fuzzer: aflsystemdfuzz-dhcp6-client Fuzz target binary: fuzz-dhcp6-client Job Type: aflasansystemd Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x60b0000002b3 Crash State:...

WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try htmlvar00028.autofocus = true; catche try...

WebKit - WebCore::Node::ensureRareData Use-After-Free Exploit

Exploit for multiple platform in category dos / poc .class1 -webkit-mask-box-image-source: urlfoo; function freememory var a; forvar i=0;i100;i++ a = new Uint8Array10241024; document.implementation.createHTMLDocument"doc"; function jsfuzzer try var00097 = document.createElement"source"; catche tr...

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free Exploit

Exploit for multiple platform in category dos / poc tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try...

WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer: heap-use-after-free on...

WebKit - WebCore::SVGTRefElement::updateReferencedText Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function freememory forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69919==ERROR: AddressSanitizer: heap-use-after-free on address...

WebKit - WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free Exploit

Exploit for multiple platform in category dos / poc htmlvar00005, noframes, diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: body::first-letter box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0.716727864979; htmlvar00001, .class1 1vmax; display:...

WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read Exploit

Exploit for multiple platform in category dos / poc -webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 = document.getElementById"htmlvar00049";...

WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free Exploit

Exploit for multiple platform in category dos / poc htmlvar00002, htmlvar00006 column-span: all; :root 1px; position: fixed; -webkit-column-width: 1px; .class2 text-indent: -webkit-shape-margin: 0px; -webkit-writing-mode: vertical-rl; '.' defselement, .class8 display: grid; 1s; function jsfuzzer ...

WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded

Exploit for multiple platform in category dos / poc ::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try var00034.setPositionhtmlvar00003; var var00043 catche try /...

open62541/fuzz_binary_message: Heap-use-after-free in UA_WorkQueue_cleanup

Project: https://github.com/open62541/open62541.git Detailed report: https://oss-fuzz.com/testcase?key=5742300546727936 Project: open62541 Fuzzer: aflopen62541fuzzbinarymessage Fuzz target binary: fuzzbinarymessage Job Type: aflasanopen62541 Platform Id: linux Crash Type: Heap-use-after-free READ...

WebKit WebCore::SVGTRefElement::updateReferencedText Use-After-Free

WebKit: Use-after-free in WebCore::SVGTRefElement::updateReferencedText CVE-2018-4315 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. PoC:...

WebKit WebCore::Node::ensureRareData Use-After-Free

WebKit: Use-after-free in WebCore::Node::ensureRareData CVE-2018-4306 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. PoC: ================================================================= .class1...

WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read

WebKit - WebCore::InlineTextBox::paint Out-of-Bounds Read -webkit-logical-width: 1px; -webkit-perspective: 1px; function jsfuzzer var htmlvar00011 = document.getElementById"htmlvar00011"; var htmlvar00019 = document.getElementById"htmlvar00019"; var htmlvar00049 =...

WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free

WebKit - WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try...

WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free

WebKit - WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer:...

WebKit WebCore::SVGTextLayoutAttributes::context Use-After-Free

WebKit: Use-after-free in WebCore::SVGTextLayoutAttributes::context CVE-2018-4318 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC: ================================================================...

WebKit WebCore::AXObjectCache::handleMenuItemSelected Use-After-Free

WebKit: Use-after-free in WebCore::AXObjectCache::handleMenuItemSelected CVE-2018-4312 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233006 on OSX. Note that accessibility features need to be enabled in order to...

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try...

WebKit WebCore::SVGAnimateElementBase::resetAnimatedType Use-After-Free

WebKit: Use-after-free in WebCore::SVGAnimateElementBase::resetAnimatedType CVE-2018-4314 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...