Microsoft Internet Explorer 9 - 'jscript9' Java­Script­Stack­Walker Memory Corruption (MS15-056)

var o­Window = window.open"about:blank"; o­Window.exec­Script'window.o­URIError = new URIError;o­URIError.name = o­URIError;' try "" + o­Window.o­URIError; catche try "" + o­Window.o­URIError; catche Description A Javascript can construct an URIError object and sets that object's name property to...

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009)

window.open"Repro.xml", "iframe"; set­Timeoutfunction window.open'javascript:voidlocation.href = "about:blank";', "iframe"; , 1000; Description This is the first security vulnerability I sold to ZDI after I quit my job at Google to live off security bug bounties. It appears I either did not analy...

Microsoft Internet Explorer 9 - jscript9 Java­Script­Stack­Walker Memory Corruption (MS15-056)

Microsoft Internet Explorer 9 - jscript9 Java­Script­Stack­Walker Memory Corruption MS15-056 var o­Window = window.open"about:blank"; o­Window.exec­Script'window.o­URIError = new URIError;o­URIError.name = o­URIError;' try "" + o­Window.o­URIError; catche try "" + o­Window.o­URIError; catche...

Microsoft Internet Explorer 9 - CDoc::Execute­Script­Uri Use-After-Free (MS13-009) Exploit

Exploit for windows platform in category dos / poc window.open"Repro.xml", "iframe"; set­Timeoutfunction window.open'javascript:voidlocation.href = "about:blank";', "iframe"; , 1000; Description This is the first security vulnerability I sold to ZDI after I quit my job at Google to live off...

Microsoft Internet Explorer 9 jscript9 JavaScriptStackWalker Memory Corruption

Since November I have been releasing details on all vulnerabilities I found in web-browsers that I had not released before. I will try to continue to publish all my old vulnerabilities, including those not in web-browser, as long as I can find some time to do so. If you find this information...

Microsoft Internet Explorer jscript9 - Java­Script­Stack­Walker Memory Corruption (MS15-056)

Exploit for windows platform in category dos / poc var o­Window = window.open"about:blank"; o­Window.exec­Script'window.o­URIError = new URIError;o­URIError.name = o­URIError;' try "" + o­Window.o­URIError; catche try "" + o­Window.o­URIError; catche Description A Javascript can construct an...

Microsoft Internet Explorer 9 CDoc::ExecuteScriptUri Use-After-Free

Since November I have been releasing details on all vulnerabilities I found in web-browsers that I had not released before. I will try to continue to publish all my old vulnerabilities, including those not in web-browser, as long as I can find some time to do so. If you find this information...

The vulnerabilities of browsers Internet Explorer and Microsoft Edge allow attackers to trigger service failures or execute arbitrary code.

The vulnerabilities of browsers Internet Explorer and Microsoft Edge allow attackers to trigger service failures or execute arbitrary code...

The vulnerability of the Internet Explorer browser and the Windows operating system allows a perpetrator to trigger a service failure or execute arbitrary code.

The vulnerability of the Internet Explorer browser and the Windows operating system allows a perpetrator to trigger a service failure or execute arbitrary code...

Vulnerability of browsers Internet Explorer and Microsoft Edge, allowing attackers to detect the presence of arbitrary files

Vulnerability of browsers Internet Explorer and Microsoft Edge, allowing attackers to detect the presence of arbitrary files...

The vulnerability of the Internet Explorer browser and the Windows operating system allows a perpetrator to determine the presence of arbitrary files.

The vulnerability of the Internet Explorer browser and the Windows operating system allows a perpetrator to determine the presence of arbitrary files...

Microsoft Internet Explorer 11 MSHTML - CGenerated­Content::Has­Generated­SVGMarker

Exploit for windows platform in category dos / poc window.onload = function document.get­Elements­By­Tag­Name"iframe"0.src = "repro-iframe.html"; Description Internally MSIE uses various lists of linked CTree­Pos objects to represent the DOM tree. For HTML/SVG elements a CTree­Node element is...

Microsoft Internet Explorer 8 MSHTML - SRun­Pointer::Span­Qualifier/Run­Type Out-Of-Bounds Read (MS1

Exploit for windows platform in category dos / poc position­fixed position: fixed; position­relative position: relative; float­left float: left; complex float: left; width: 100%; complex:first-line clear: left; window.onload = function boom o­Element­float­left =...

Microsoft Internet Explorer 10 MSHTML - CEdit­Adorner::Detach Use-After-Free (MS13-047) Exploit

Exploit for windows platform in category dos / poc var o­Window = window.open"window.xhtml"; set­Intervalfunction try o­Window.eval"" + function document.design­Mode = "on"; document.exec­Command"Select­All"; var o­Selection = window.get­Selection; o­Selection.collapsedocument,1;...

Microsoft Internet Explorer 8 / 9 / 10 / 11 MSHTML - DOMImplementation Type Confusion Exploit

Exploit for windows platform in category dos / poc Source: http://blog.skylined.nl/20161128001.html Synopsis A specially crafted web-page can cause a type confusion vulnerability in Microsoft Internet Explorer 8 through to 11. An attacker can cause code to be executed with a stack layout it does...

Microsoft Internet Explorer MSHTML DOMImplementation Type Confusion

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the twentieth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throug...

Vulnerabilities of Microsoft Edge and Internet Explorer browsers, which allow attackers to escalate their privileges

The vulnerabilities of Microsoft Edge and Internet Explorer are related to errors in access control for namespace resources. Exploiting these vulnerabilities can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the Internet Explorer browser, which allows a violator to trigger a service failure or execute arbitrary code

The vulnerability of the Internet Explorer browser arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure memory corruption by using a specially crafted web page...

Microsoft Internet Explorer 891011 - MSHTML DOMImplementation Type Confusion (MS16-009)

Microsoft Internet Explorer 891011 - MSHTML DOMImplementation Type Confusion MS16-009 Source: http://blog.skylined.nl/20161128001.html Synopsis A specially crafted web-page can cause a type confusion vulnerability in Microsoft Internet Explorer 8 through to 11. An attacker can cause code to be...

Microsoft Internet Explorer 11 - MSHTML 'CGenerated­Content::Has­Generated­SVGMarker' Type Confusion

window.onload = function document.get­Elements­By­Tag­Name"iframe"0.src = "repro-iframe.html"; Description Internally MSIE uses various lists of linked CTree­Pos objects to represent the DOM tree. For HTML/SVG elements a CTree­Node element is created, which embeds two CTree­Pos instances: one tha...