December 13, 2016 — KB3206632 (OS Build 14393.576)

None None...

Microsoft Internet Explorer 9 IEFRAME CSelectionInteractButtonBehavior::_UpdateButtonLocation Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the thirtieth entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161212001.html. There you can find a repro that triggered th...

Microsoft Internet Explorer 9 - IEFRAME CSelection­Interact­Button­Behavior::_Update­Button­Location Use-After-Free (MS13-047)

Microsoft Internet Explorer 9 - IEFRAME CSelection­Interact­Button­Behavior::Update­Button­Location Use-After-Free MS13-047 function go document.exec­Command'Select­All'; document.exec­Command'superscript'; set­Timeoutfunction o­Sup­Element=document.get­Elements­By­Tag­Name'sup'0;...

Microsoft Internet Explorer 9 - IEFRAME CSelection­Interact­Button­Behavior::_Update­Button­Location Use-After-Free (MS13-047)

function go document.exec­Command'Select­All'; document.exec­Command'superscript'; set­Timeoutfunction o­Sup­Element=document.get­Elements­By­Tag­Name'sup'0; o­Sup­Element.swap­Nodedocument.document­Element; , 0; !-- Time-line 27 September 2012: This vulnerability was found through fuzzing. 3...

Microsoft Internet Explorer 9 MSHTML - CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (2)

Exploit for windows platform in category dos / poc !-- Source: http://blog.skylined.nl/20161208001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate ...

Microsoft Internet Explorer 9 MSHTML - CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (1)

Exploit for windows platform in category dos / poc window.onload=functionlocation.reload;; text .float float:left; .zoom zoom:3000%; .border::first-let...

Microsoft Internet Explorer 9 MSHTML - CElement::Has­Flag Memory Corruption Exploit

Exploit for windows platform in category dos / poc // First tag can be any inline but must NOT be closed yet // Second tag can be anything that's not inline. // "text1" can be anything document.write'text1'; // The tree is in good shape. show"DOM Tree after first write",...

Informatica: [kb.informatica.com] DOM based XSS in the bindBreadCrumb function

The bindBreadCrumb function, which is called after the document is loaded: javascript $document.readyfunction bindBreadCrumb; ; has the following insecure link assignments, that use non-encoded URL values: javascript strChild = "Search Results"; strChild = "Search Results"; strChild = "Search...

Microsoft Internet Explorer 9 MSHTML CElement::HasFlag Memory Corruption

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the twenty-ninth entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161209001.html. There you can find a repro that triggered...

Microsoft Internet Explorer MSHTML CDispNode::InsertSiblingNode Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the twenty-seventh entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161207001.html. There you can find a repro that trigger...

Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (1)

Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free MS13-037 1 window.onload=functionlocation.reload;; text .float float:left; .zoom zoom:3000%; .border::first-letter...

Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (2)

Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free MS13-037 2 !-- Source: http://blog.skylined.nl/20161208001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this...

Microsoft Internet Explorer 9 - MSHTML CElement::Has­Flag Memory Corruption

Microsoft Internet Explorer 9 - MSHTML CElement::Has­Flag Memory Corruption // First tag can be any inline but must NOT be closed yet // Second tag can be anything that's not inline. // "text1" can be anything document.write'text1'; // The tree is in good shape. show"DOM Tree after first write",...

Cumulative Update for Windows 10 Version 1607 and Windows Server 2016: December 9, 2016

None None...

Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (1)

window.onload=functionlocation.reload;; text .float float:left; .zoom zoom:3000%; .border::first-letter border-top:1px; !-- Time-line 1 November 2012: This vulnerability wa...

Microsoft Internet Explorer 9 - MSHTML CDisp­Node::Insert­Sibling­Node Use-After-Free (MS13-037) (2)

!-- Source: http://blog.skylined.nl/20161208001.html Synopsis A specially crafted web-page can trigger a memory corruption vulnerability in Microsoft Internet Explorer 9. I did not investigate this vulnerability thoroughly, so I cannot speculate on the potential impact or exploitability. Known...

Microsoft Internet Explorer 9 - MSHTML CElement::Has­Flag Memory Corruption

// First tag can be any inline but must NOT be closed yet // Second tag can be anything that's not inline. // "text1" can be anything document.write'text1'; // The tree is in good shape. show"DOM Tree after first write", get­Element­Treedocument.body; // At this point, it appears that MSIE is sti...

Microsoft Internet Explorer 9 MSHTML CDispNode::InsertSiblingNode Use-After-Free

Since November I have been releasing details on all vulnerabilities I found that I have not released before. This is the twenty-eighth entry in the series. This information is available in more detail on my blog at http://blog.skylined.nl/20161208001.html. There you can find a repro that triggere...

Hacking Millions with Just an Image — Recipe: Pixels, Ads & Exploit Kit

If you have visited any popular mainstream website over the past two months, your computer may have been infected — Thanks to a new exploit kit discovered by security researchers. Researchers from antivirus provider ESET released a report on Tuesday stating that they have discovered an exploit ki...

Microsoft Internet Explorer 9 jscript9 JavaScriptStackWalker Memory Corruption

Since November I have been releasing details on all vulnerabilities I found in web-browsers that I had not released before. I will try to continue to publish all my old vulnerabilities, including those not in web-browser, as long as I can find some time to do so. If you find this information...