Microsoft Internet Explorer 8/9/10/11 - MSHTML 'DOMImplementation' Type Confusion (MS16-009)

Source: http://blog.skylined.nl/20161128001.html Synopsis A specially crafted web-page can cause a type confusion vulnerability in Microsoft Internet Explorer 8 through to 11. An attacker can cause code to be executed with a stack layout it does not expect, or have code attempt to execute a metho...

Microsoft Internet Explorer 11 - MSHTML CGenerated­Content::Has­Generated­SVGMarker Type Confusion

Microsoft Internet Explorer 11 - MSHTML CGenerated­Content::Has­Generated­SVGMarker Type Confusion window.onload = function document.get­Elements­By­Tag­Name"iframe"0.src = "repro-iframe.html"; Description Internally MSIE uses various lists of linked CTree­Pos objects to represent the DOM tree. F...

Microsoft Internet Explorer 8 - MSHTML SRun­Pointer::Span­QualifierRun­Type Out-Of-Bounds Read (MS15-009)

Microsoft Internet Explorer 8 - MSHTML SRun­Pointer::Span­QualifierRun­Type Out-Of-Bounds Read MS15-009 position­fixed position: fixed; position­relative position: relative; float­left float: left; complex float: left; width: 100%; complex:first-line clear: left; window.onload = function boom...

Microsoft Internet Explorer 8 - MSHTML 'SRun­Pointer::Span­Qualifier/Run­Type' Out-Of-Bounds Read (MS15-009)

position­fixed position: fixed; position­relative position: relative; float­left float: left; complex float: left; width: 100%; complex:first-line clear: left; window.onload = function boom o­Element­float­left = document.create­Element'float­left'; o­Element­complex =...

Vulnerabilities of Microsoft Edge and Internet Explorer browsers, which allow attackers to trigger service failures or execute arbitrary code.

The vulnerability of Microsoft Edge and Internet Explorer is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to access user accounts by analyzing the memory dump...

Vulnerability of Microsoft Edge and Internet Explorer browsers, allowing attackers to compromise user accounts

The vulnerability of Microsoft Edge and Internet Explorer is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to access user accounts by analyzing the memory dump...

Vulnerabilities of Microsoft Edge and Internet Explorer browsers, which allow attackers to escalate their privileges

The vulnerabilities of Microsoft Edge and Internet Explorer are related to errors in access control of namespace resources. Exploiting these vulnerabilities can allow a malicious actor to enhance their privileges using undefined vectors...

Vulnerabilities of Microsoft Edge and Internet Explorer browsers, which allow attackers to trigger service failures or execute arbitrary code.

The vulnerabilities of Microsoft Edge and Internet Explorer are caused by operations that go beyond the buffer boundaries in memory. Exploiting these vulnerabilities allows a malicious actor to execute arbitrary code or trigger a service failure memory corruption through a specially crafted web...

Microsoft Internet Explorer 10 - MSHTML CEdit­Adorner::Detach Use-After-Free (MS13-047)

Microsoft Internet Explorer 10 - MSHTML CEdit­Adorner::Detach Use-After-Free MS13-047 var o­Window = window.open"window.xhtml"; set­Intervalfunction try o­Window.eval"" + function document.design­Mode = "on"; document.exec­Command"Select­All"; var o­Selection = window.get­Selection;...

The vulnerability of the Internet Explorer browser, which allows a violator to trigger a service failure or execute arbitrary code

The vulnerability of the Internet Explorer browser arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure memory corruption by using a specially crafted web page...

The vulnerability of the Internet Explorer browser, which allows a violator to trigger a service failure or execute arbitrary code

The vulnerability of the Internet Explorer browser arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause a service failure memory corruption by using a specially crafted web page...

Microsoft Internet Explorer 10 - MSHTML 'CEdit­Adorner::Detach' Use-After-Free (MS13-047)

var o­Window = window.open"window.xhtml"; set­Intervalfunction try o­Window.eval"" + function document.design­Mode = "on"; document.exec­Command"Select­All"; var o­Selection = window.get­Selection; o­Selection.collapsedocument,1; document.exec­Command"Insert­Image", false;...

Microsoft Internet Explorer 11 MSHTML CGeneratedContent::HasGeneratedSVGMarker Type Confusion

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the eighteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throu...

Microsoft Internet Explorer 10 MSHTML CEditAdorner::Detach Use-After-Free

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the nineteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throu...

SHA-1 ウェブサーバー証明書は警告！ウェブサイト管理者は影響の最終確認を

こんにちは、村木ゆりかです。 以前よりマイクロソフト セキュリティ アドバイザリ 2880823、そして、このブログでもご案内しているとおり、証明書に利用されているハッシュ アルゴリズム SHA-1 の安全性の低下に伴い、利用廃止が進められています。 マイクロソフトでは、2017 年 2 月 14 日 米国時間 2017 年中旬 2017 日 5 月 9 日 米国時間 より、SHA-1 の TLS サーバー証明書を利用するウェブサイトを、Microsoft Edge および Internet Explorer 11...

Microsoft Internet Explorer 8 MSHTML - 'Ptls5::Ls­Find­Span­Visual­Boundaries' Memory Co

Exploit for windows platform in category dos / poc 0day.today 2018-01-02...

Microsoft Internet Explorer 8 jscript - 'Reg­Exp­Base::FBad­Header' Use-After-Free (MS15

Exploit for windows platform in category dos / poc // This Po­C attempts to exploit a use-after-free bug in Microsoft Internet // Explorer 8. // See http://blog.skylined.nl/20161116001.html for details. var r=new Reg­Exp"A|x|x|xx|xxxxxxxxxxxxxxxxxxxx+", "g"; "A".replacer, function // Force OLEAUT...

Microsoft Internet Explorer 8 8 MSHTML SRunPointer::SpanQualifier/RunType Out-Of-Bounds Read

Throughout November, I plan to release details on vulnerabilities I found in web-browsers which I've not released before. This is the sixteenth entry in that series. Unfortunately I won't be able to publish everything within one month at the current rate, so I may continue to publish these throug...

Microsoft Cutting Off SHA-1 Support in February for Edge, IE 11

Microsoft confirmed that Feb. 14, 2017 is the cutoff date for SHA-1 support in its Microsoft Edge and Internet Explorer 11 browsers. After that date, neither browser will immediately load sites still running SHA-1 certificates and users will be shown an invalid certificate warning. Users will als...

Microsoft Internet Explorer 8 - MSHTML Ptls5::Ls­Find­Span­Visual­Boundaries Memory Corruption

Microsoft Internet Explorer 8 - MSHTML Ptls5::Ls­Find­Span­Visual­Boundaries Memory Corruption...