3001 matches found
WebKit - WebCore::Node::ensureRareData Use-After-Free
WebKit - WebCore::Node::ensureRareData Use-After-Free .class1 -webkit-mask-box-image-source: urlfoo; function freememory var a; forvar i=0;i100;i++ a = new Uint8Array10241024; document.implementation.createHTMLDocument"doc"; function jsfuzzer try var00097 = document.createElement"source"; catche...
WebKit - 'WebCore::SVGTextLayoutAttributes::context' Use-After-Free
tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try var00162.replaceWithhtmlvar00022; catche Text !--...
WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free
WebKit - WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free ::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try...
WebKit WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free
WebKit: Use-after-free in WebCore::RenderMultiColumnSet::updateMinimumColumnHeight CVE-2018-4323 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233419 on OSX. The vulnerability has also been confirmed on Safari 11.1...
WebKit WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded Use-After-Free
WebKit: Use-after-free in WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded CVE-2018-4197 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...
WebKit - 'WebCore::SVGAnimateElementBase::resetAnimatedType' Use-After-Free
function eventhandler2 try var var00138 = svgvar00013.parentNode; catche try htmlvar00006.setAttribute"onfocusin", "eventhandler2"; catche try svgvar00001.aftervar00138; catche function eventhandler5 try htmlvar00028.autofocus = true; catche try htmlvar00034.appendChildhtmlvar00006; catche !--...
WebKit - 'WebCore::RenderTreeBuilder::removeAnonymousWrappersForInlineChildrenIfNeeded' Use-After-Free
::selection, input:focus, .class0, ul::first-letter -webkit-column-count: 85; float: left; function jsfuzzer var fuzzervars = ; try / / var00034 = document.getSelection; catche try var00034.setPositionhtmlvar00003; var var00043 catche try / newvarvar00104:Element / var var00104 = htmlvar00013;...
WebKit WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free
WebKit: Use-after-free in WebCore::RenderLayer::updateDescendantDependentFlags CVE-2018-4317 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of the latest WebKit source on OSX. PoC:...
WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free
WebKit - WebCore::RenderMultiColumnSet::updateMinimumColumnHeight Use-After-Free htmlvar00002, htmlvar00006 column-span: all; :root 1px; position: fixed; -webkit-column-width: 1px; .class2 text-indent: -webkit-shape-margin: 0px; -webkit-writing-mode: vertical-rl; '.' defselement, .class8 display:...
WebKit WebCore::InlineTextBox::paint Out-Of-Bounds Read
WebKit: Out-of-bounds read in WebCore::InlineTextBox::paint CVE-2018-4328 There is a out-of-bounds read security vulnerability in WebKit. The vulnerability was confirmed on the ASan build of WebKit revision 233419 on OSX. The vulnerability has also been confirmed on Safari 11.1.1 sources grabbed...
WebKit - WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free
WebKit - WebCore::RenderLayer::updateDescendantDependentFlags Use-After-Free htmlvar00005, noframes, diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: body::first-letter box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0.716727864979; htmlvar00001,...
WebKit - 'WebCore::SVGTRefElement::updateReferencedText' Use-After-Free
function freememory forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69919==ERROR: AddressSanitizer: heap-use-after-free on address 0x615000090e14 at pc 0x00011551a61a bp 0x7ffee91562a0...
WebKit - 'WebCore::AXObjectCache::handleMenuItemSelected' Use-After-Free
function jsfuzzer var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69238==ERROR: AddressSanitizer: heap-use-after-free on address 0x6120000aaa54 at pc 0x0003280b861a bp...
WebKit - 'WebCore::RenderLayer::updateDescendantDependentFlags' Use-After-Free
htmlvar00005, noframes, diplay: inline; padding-top: 0vw; -webkit-column-count: 41; transition-delay: body::first-letter box-flex-group: -webkit-background-size: contain; -webkit-opacity: 0.716727864979; htmlvar00001, .class1 1vmax; display: contents; left: transform-style: inherit;...
WebKit - 'WebCore::RenderMultiColumnSet::updateMinimumColumnHeight' Use-After-Free
htmlvar00002, htmlvar00006 column-span: all; :root 1px; position: fixed; -webkit-column-width: 1px; .class2 text-indent: -webkit-shape-margin: 0px; -webkit-writing-mode: vertical-rl; '.' defselement, .class8 display: grid; 1s; function jsfuzzer / newvarhtmlvar00078:HTMLHRElement / htmlvar00078 =...
graphicsmagick/coder_MVG_fuzzer: Stack-buffer-overflow in MagickGetToken
Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5634802938544128 Project: graphicsmagick Fuzzer: aflgraphicsmagickcoderMVGfuzzer Fuzz target binary: coderMVGfuzzer Job Type: aflasangraphicsmagick Platform Id: linux Crash Type:...
ffmpeg/ffmpeg_AV_CODEC_ID_ILBC_fuzzer: Stack-buffer-underflow in vector_multiplication
Project: https://git.ffmpeg.org/ffmpeg.git Detailed report: https://oss-fuzz.com/testcase?key=5638941487661056 Project: ffmpeg Fuzzer: aflffmpegAVCODECIDILBCfuzzer Fuzz target binary: ffmpegAVCODECIDILBCfuzzer Job Type: aflasanffmpeg Platform Id: linux Crash Type: Stack-buffer-underflow WRITE 2...
keystone/fuzz_asm_sparc64be: Bad-free in llvm_ks::MCEncodedFragmentWithFixups<32u, 4u>::~MCEncodedFragmentWithFixups
Project: https://github.com/keystone-engine/keystone.git Detailed report: https://oss-fuzz.com/testcase?key=5745963403051008 Project: keystone Fuzzer: aflkeystonefuzzasmsparc64be Fuzz target binary: fuzzasmsparc64be Job Type: aflasankeystone Platform Id: linux Crash Type: Bad-free Crash Address:...
skia/api_raster_n32_canvas: Crash in SkScan::DAAFillPath
Project: https://skia.googlesource.com/skia.git Detailed report: https://oss-fuzz.com/testcase?key=5713029673517056 Project: skia Fuzzer: aflskiaapirastern32canvas Fuzz target binary: apirastern32canvas Job Type: aflasanskia Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x01018100810...
botan/mode_padding: Heap-buffer-overflow in ref_oneandzero_unpad
Project: https://github.com/randombit/botan.git Detailed report: https://oss-fuzz.com/testcase?key=5645045441495040 Project: botan Fuzzer: aflbotanmodepadding Fuzz target binary: modepadding Job Type: aflasanbotan Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...