macOS / iOS JavaScriptCore - JSValue Use-After-Free in ValueProfiles

While fuzzing JSC, I encountered the following JS program which crashes JSC from current HEAD and release /System/Library/Frameworks/JavaScriptCore.framework/Resources/jsc: // Run with --useConcurrentJIT=false --thresholdForJITAfterWarmUp=10 function fullGC for var i = 0; i 10; i++ new...

Denial Of Service

gc is vulnerable to denial of service DoS. It is possible due to lack of parameter sanitization, allowing the attacker to pass malicious input to the alloc and calloc routines...

Tron Foundation: DOS attack by consuming all CPU and using all available memory

Summary: A single request to submit a post to /wallet/deploycontract with several megabytes of bytecode along with CPU intensive long parsing will consume CPU for about 10 minutes while still holding several megabytes of bytecode in heap. With enough requests lets say 1K-10K depending upon...

Command Execution Vulnerability in Dieppe Firewall Appliances

Ltd. "DP Technology" is a high-tech enterprise integrating R&D, production and sales in the field of network security and application delivery. With the mission of "making the network simpler, smarter and safer", DIPTECH continues to innovate and provide customers with leading products and...

CVE-2017-12174

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError...

CVE-2017-12174

CVE-2017-12174 affects Artemis and HornetQ when configured with UDP discovery and JGroups discovery; a huge byte array is created upon receiving an unexpected multicast message, leading to heap memory exhaustion, full GC, or OutOfMemoryError. The OSV/Nessus Red Hat advisories summarize this as pa...

CVE-2017-1002017

Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability...

CVE-2017-1002017: Improper Neutralization of Input During Web Page Generation

Vulnerability in wordpress plugin gift-certificate-creator v1.0, The code in gc-list.php doesn't sanitize user input to prevent a stored XSS vulnerability...

PT-2017-11006

Name of the Vulnerable Software and Affected Versions gift-certificate-creator version 1.0 Description The issue arises from a stored XSS vulnerability due to insufficient sanitization of user input in the gc-list.php code. Recommendations For gift-certificate-creator version 1.0, consider updati...

WebKit JSC arrayProtoFuncSplice Initialization Fail

WebKit: JSC: arrayProtoFuncSplice doesn't initialize all indices. CVE-2017-6980 Here's a snippet of arrayProtoFuncSplice. EncodedJSValue JSCHOSTCALL arrayProtoFuncSpliceExecState exec ... result = JSArray::tryCreateForInitializationPrivatevm,...

MGASA-2017-0157 Updated gc packages fix security vulnerability

Kuang-che Wu discovered that multiple integer overflow vulnerabilities existed in libgc. An attacker could use these to cause a denial of service application crash or possibly execute arbitrary code CVE-2016-9427...

Microsoft MsMpEng - Remotely Exploitable Use-After-Free due to Design Issue in GC Engine Exploit

Exploit for windows platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1258 MsMpEng's JS engine uses garbage collection to manage the lifetime of Javascript objects. During mark and sweep the GC roots the vectors representing the JS stack as well as a...

Microsoft MsMpEng - Remote Use-After-Free Due to Design Issue in GC Engine

Microsoft MsMpEng - Remote Use-After-Free Due to Design Issue in GC Engine Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1258 MsMpEng's JS engine uses garbage collection to manage the lifetime of Javascript objects. During mark and sweep the GC roots the vectors representing t...

Microsoft MsMpEng - Remote Use-After-Free Due to Design Issue in GC Engine

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1258 MsMpEng's JS engine uses garbage collection to manage the lifetime of Javascript objects. During mark and sweep the GC roots the vectors representing the JS stack as well as a few other hardcoded objects, traversing reachable...

Internet Bug Bounty: Incorrect GC behavior in xxlimited could lead to use-after-free

Issue submitted: http://bugs.python.org/issue29398 xxlimited module exist only in Python3.6 compiled on Linux. Starting program: /usr/bin/python3.6 xlimited.py Thread debugging using libthreaddb enabled Using host libthreaddb library "/usr/lib/libthreaddb.so.1". Program received signal SIGSEGV,...

openSUSE Security Update : gc (openSUSE-2016-1487)

This update for gc fixes the following issues : - integer overflow in GCMALLOCATOMIC CVE-2016-9427, bsc1011276 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2016-1487. The text...

openSUSE Security Update : gc (openSUSE-2016-1479)

This update for gc fixes the following issues : - integer overflow in GCMALLOCATOMIC CVE-2016-9427, bsc1011276 This update was imported from the SUSE:SLE-12:Update update project. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

SUSE SLED12 / SLES12 Security Update : gc (SUSE-SU-2016:3057-1)

This update for gc fixes the following issues : - integer overflow in GCMALLOCATOMIC CVE-2016-9427, bsc1011276 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as...

SUSE SLED12 / SLES12 Security Update : php5 (SUSE-SU-2016:2975-1)

This update for php5 fixes the following issues : - CVE-2016-9137: Use After Free in unserialize bsc1008029 - CVE-2016-5773: ZipArchive class Use After Free Vulnerability in PHP's GC bsc986247 Note that Tenable Network Security has extracted the preceding description block directly from the SUSE...

Internet Bug Bounty: Use After Free Vulnerability in SNMP with GC and unserialize()

https://bugs.php.net/bug.php?id=72479 P.S. This bug can be triggered remotely without call to the gccollectcycles since GC can also be invoked automatically in during deserialization. Like the following code: $xxx, 'yyy' = 1; $callgcpoc = strreplace'yyy', 'xxx', serialize$arr;...